First-Contact External Email Senders

Hunt Hypothesis

This hypothesis targets initial access attempts via phishing (T1566), where adversaries establish new external email relationships to deliver malicious payloads or harvest credentials. Proactively hunting for these first-contact senders allows the SOC to identify and validate suspicious external actors before they progress to subsequent stages of the kill chain, such as credential theft or lateral movement.

KQL Query

// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.
// let ExcludeDomains = dynamic(["contoso.com", "fabrikam.com"]);
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and isnotempty(SenderFromAddress)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])
// | where SenderDomain !in~ (ExcludeDomains)
| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain
| top 20 by FirstSeen desc
| project Sender = SenderFromAddress, SenderDomain, FirstSeen, Messages, ThreatMessages

Analytic Rule Definition

id: a7373b95-2471-4169-9bca-412d6c41334d
name: First-Contact External Email Senders
description: |
  This query lists external email senders seen for the first time in the period (most recent first), surfacing new first-contact relationships, using the EmailEvents table.
description-detailed: |
  New or first-contact sender relationships, especially ones already carrying threats, are a common precursor to phishing, business email compromise (BEC) and supply-chain attacks. This query lists inbound external senders ordered by when they were first seen in the period, with their message and threat counts. In tenants with longer history this highlights genuinely new relationships worth reviewing.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.
  // let ExcludeDomains = dynamic(["contoso.com", "fabrikam.com"]);
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and isnotempty(SenderFromAddress)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])
  // | where SenderDomain !in~ (ExcludeDomains)
  | summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain
  | top 20 by FirstSeen desc
  | project Sender = SenderFromAddress, SenderDomain, FirstSeen, Messages, ThreatMessages
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/First-Contact External Email Senders.yaml)

False Positive Guidance

• Vendor Onboarding and Initial Contact: When a new SaaS vendor (e.g., Salesforce, Workday, or ServiceNow) is onboarded, their initial support or account management emails often originate from a new domain or alias not previously seen in the mailbox.
  • Filter/Exclusion: Exclude senders from known vendor domains (e.g., @salesforce.com, @workday.com) or those associated with specific distribution lists used for vendor communications.
• Automated System Notifications and Alerts: Scheduled jobs or monitoring tools (e.g., Datadog, PagerDuty, or internal CI/CD pipelines like Jenkins/GitLab) may send the first alert or status report to a new recipient or from a new service account email address after a system update or new service deployment.
  • Filter/Exclusion: Exclude senders matching known monitoring or CI/CD service account patterns (e.g., @monitoring.internal, @ci-cd-bot) or emails with subject lines containing keywords like “Alert,” “Status,” or “Report.”
• New Employee or Contractor Onboarding: When a new employee or contractor is added to the organization, their first email to existing staff or external partners will trigger this rule, as their address is new to the recipient’s history.
  • Filter/Exclusion: Exclude senders whose email addresses match the organization’s primary domain (e.g., @company.com) or those associated with HR onboarding distribution lists.
• Marketing or Newsletter Subscriptions: Users may subscribe to new industry newsletters, product updates, or promotional emails from vendors (e.g., Microsoft 365 updates, AWS announcements, or industry-specific publications), which appear as new external senders.
  • Filter/Exclusion: Exclude senders from known marketing domains (e.g., @newsletters.com, `@updates.microsoft