Impersonation and Spoof Detections by Sender Country

Hunt Hypothesis

This hypothesis targets Business Email Compromise (BEC) attacks where adversaries leverage geographically inconsistent sender locations to impersonate trusted entities, aligning with MITRE technique T1566. Proactively hunting for these anomalies in Azure Sentinel allows the SOC to identify suspicious inbound communications that bypass standard authentication checks, reducing the risk of successful social engineering and credential theft.

KQL Query

// Inbound impersonation and spoof (BEC) detections by sender-IP country. Country is from IP geolocation and is approximate.
EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
| where (DetectionMethods has "Impersonation" or DetectionMethods has "Spoof") and isnotempty(SenderIPv4)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)
| where isnotempty(Country)
| summarize ImpersonationEmails = countif(DetectionMethods has "Impersonation"), SpoofEmails = countif(DetectionMethods has "Spoof"), SenderIPs = dcount(SenderIPv4) by Country
| extend TotalBEC = ImpersonationEmails + SpoofEmails
| top 20 by TotalBEC
| project Country, ImpersonationEmails, SpoofEmails, SenderIPs, TotalBEC

Analytic Rule Definition

id: 0863f418-5681-4532-a097-033f6332d353
name: Impersonation and Spoof Detections by Sender Country
description: |
  This query summarizes inbound impersonation and spoof (BEC) detections by the geographic country of the sending IP address, using the EmailEvents table.
description-detailed: |
  Mapping impersonation and spoof (BEC) detections to the country of the sending IP address helps identify the regions and sending infrastructure behind targeted email attacks. This query resolves the sender IPv4 address to a country and counts inbound impersonation and spoof detections per country, with the number of distinct sending IPs. Use it to spot high-risk sending regions for targeted mitigation. Country is derived from IP geolocation and is approximate.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Inbound impersonation and spoof (BEC) detections by sender-IP country. Country is from IP geolocation and is approximate.
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
  | where (DetectionMethods has "Impersonation" or DetectionMethods has "Spoof") and isnotempty(SenderIPv4)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)
  | where isnotempty(Country)
  | summarize ImpersonationEmails = countif(DetectionMethods has "Impersonation"), SpoofEmails = countif(DetectionMethods has "Spoof"), SenderIPs = dcount(SenderIPv4) by Country
  | extend TotalBEC = ImpersonationEmails + SpoofEmails
  | top 20 by TotalBEC
  | project Country, ImpersonationEmails, SpoofEmails, SenderIPs, TotalBEC
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Impersonation and Spoof Detections by Sender Country.yaml)

False Positive Guidance

• Global Customer Support Ticketing System

  • Scenario: A SaaS-based customer support platform (e.g., Zendesk, Freshdesk, or Salesforce Service Cloud) sends automated “ticket created” or “status update” emails to internal staff. If the vendor’s mail servers are hosted in a region different from the expected corporate footprint (e.g., a US-based company receiving support emails from a Singapore-based data center), the system may flag these as potential spoofing or impersonation attempts due to the unexpected geographic origin.
  • Filter/Exclusion: Exclude inbound emails where the Sender domain matches the known support vendor’s domain (e.g., @zendesk.com, @freshdesk.com) AND the MessageClass or subject line contains standard automation keywords like “Ticket #” or “Status Update”.

• Distributed CI/CD Pipeline Notifications

  • Scenario: Enterprise CI/CD tools (e.g., Jenkins, GitLab CI, or Azure DevOps) often distribute build notifications across global regions to reduce latency. A build triggered in a US-East region might send notification emails from an EU-West or APAC node if the pipeline is configured for multi-region redundancy or if the notification service is a global SaaS offering. This can trigger country-based spoofing detections if the primary corporate IP range is localized.
  • Filter/Exclusion: Exclude emails from known CI/CD notification domains (e.g., @gitlab.com, @jenkins.io, @dev.azure.com) where the Sender IP address is part of the vendor’s documented public IP range, regardless of the geolocation country.

• Scheduled Financial Reporting from Cloud Providers

  • Scenario: Cloud providers (e.g., AWS, Azure, GCP) send scheduled billing or usage reports. These emails are often generated from centralized regional hubs (e.g., AWS