This hypothesis targets adversaries who exploit the gap between initial email delivery and automated remediation to execute malicious payloads before Defender for Office 365 can isolate or delete the message. Proactively hunting for this behavior allows the SOC to identify persistent failure patterns or high-volume success rates that may indicate misconfigured policies, targeted evasion tactics, or compromised mailboxes that are slipping through automated defenses.
EmailPostDeliveryEvents
| where Timestamp > ago(30d)
| where ActionType == "Automated Remediation"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| summarize Count = count() by bin(Timestamp, 1d), ActionResult
| render timechart
id: e189343d-f3f1-4d2d-a82e-29b4619d9091
name: Automated Remediation Efficiency Over Time
description: |
This query trends the outcome (success versus failure) of Microsoft Defender for Office 365 automated remediation actions over time, using the EmailPostDeliveryEvents table.
description-detailed: |
Automated Investigation and Response (AIR) can remediate malicious mail after delivery. This query counts automated remediation events by result over time, deduplicated to the latest event per message and recipient, so SOC teams can see whether automated remediation is succeeding and spot spikes in failures that warrant attention.
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailPostDeliveryEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
EmailPostDeliveryEvents
| where Timestamp > ago(30d)
| where ActionType == "Automated Remediation"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| summarize Count = count() by bin(Timestamp, 1d), ActionResult
| render timechart
version: 1.0.0
Scenario: A legacy on-premises Exchange server or third-party mail gateway (e.g., Proofpoint, Mimecast) is configured to perform its own automated remediation (such as quarantining or deleting messages) before the message is fully delivered to the Microsoft 365 tenant. If the M365 Defender policy is also active, it may attempt to remediate the same message, resulting in a “failure” status in EmailPostDeliveryEvents because the message is already moved or deleted by the upstream tool.
RemediationAction is “Delete” or “Quarantine” and the MessageId matches known IDs from the upstream gateway’s audit logs, or filter by Sender addresses associated with the on-premises mail flow connectors.Scenario: An administrator is performing a bulk cleanup or migration task using PowerShell (New-MessageClassification or Remove-Message) or the Exchange Admin Center to delete old messages that have already been processed by Defender. If the Defender policy is still active, it may log a remediation attempt that fails because the message no longer exists in the mailbox.
AdminAuditLogs or UnifiedAuditLog to exclude remediation events that occur within a 5-minute window of an Remove-Message or New-MessageClassification admin action on the same MessageId.Scenario: A scheduled job or API integration (e.g., a custom Python script using the Microsoft Graph API) is used to automatically archive or move messages from specific senders (like newsletters or system alerts) to an Archive folder. If the Defender policy includes a rule to “Move to Archive” for these senders, a race condition can occur where the API moves the message first, causing the Defender remediation to