Largest Malicious Email Campaigns by Cluster

Hunt Hypothesis

This hypothesis targets large-scale phishing campaigns (T1566) by identifying clusters of malicious inbound emails, indicating coordinated adversary efforts to overwhelm defenses or exploit specific vulnerabilities. Proactively hunting for these high-volume clusters in Azure Sentinel allows the SOC to detect and isolate widespread attack waves early, reducing the mean time to respond before individual users interact with the malicious payloads.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and EmailClusterId > 0
| where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| summarize Messages = count(),
            Recipients = dcount(RecipientEmailAddress),
            SenderDomains = dcount(SenderFromDomain),
            ThreatTypesRaw = make_set(ThreatTypes, 50),
            SampleSubjects = make_set(Subject, 5),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
        by EmailClusterId
| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, ", "), ", "), dynamic([])))
| top 20 by Messages
| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Threat Mix']=ThreatMix, ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen

Analytic Rule Definition

id: cb73a6da-421d-4596-92e5-0984e02ece9e
name: Largest Malicious Email Campaigns by Cluster
description: |
  This query surfaces the largest malicious inbound email campaigns, clustered by EmailClusterId, with one row per attack wave, using the EmailEvents table.
description-detailed: |
  Microsoft Defender for Office 365 groups related malicious messages into campaigns via EmailClusterId. This query returns the top campaigns by message volume, deduplicated to the latest record per message and recipient, with the number of messages and recipients, distinct sender domains, the mix of threat types, and sample subjects, so analysts can quickly triage the biggest attack waves.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and EmailClusterId > 0
  | where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | summarize Messages = count(),
              Recipients = dcount(RecipientEmailAddress),
              SenderDomains = dcount(SenderFromDomain),
              ThreatTypesRaw = make_set(ThreatTypes, 50),
              SampleSubjects = make_set(Subject, 5),
              FirstSeen = min(Timestamp),
              LastSeen = max(Timestamp)
          by EmailClusterId
  | extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, ", "), ", "), dynamic([])))
  | top 20 by Messages
  | project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Threat Mix']=ThreatMix, ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Top Attacks/Largest Malicious Email Campaigns by Cluster.yaml)

False Positive Guidance

• Bulk Marketing or Newsletter Campaigns with Aggressive Link Tracking

  • Scenario: Enterprise marketing automation platforms (e.g., Mailchimp, HubSpot, or Salesforce Marketing Cloud) often send large volumes of emails to internal stakeholders or external partners. If these platforms use unique, short-lived tracking URLs for each recipient or append complex query parameters, the email clustering algorithm may group these distinct but related messages into a single “cluster.” If the clustering logic incorrectly identifies the high volume or specific header patterns as a coordinated attack, it triggers a false positive.
  • Filter/Exclusion: Exclude emails where the SenderDomain matches known marketing automation domains (e.g., *.mailchimp.com, *.hubspot.net) or where the Subject contains standard newsletter tags (e.g., “Newsletter”, “Digest”, “Weekly Update”). Additionally, consider excluding clusters where the RecipientCount is high but the UniqueSenderCount is low (indicating a single source).

• Scheduled System Notifications from Monitoring and Alerting Tools

  • Scenario: Infrastructure monitoring tools like Datadog, New Relic, Splunk, or PagerDuty send automated alerts to distribution lists (e.g., ops-alerts@company.com). These alerts are often generated in bursts during incident spikes or scheduled health checks, resulting in a high volume of emails from a single sender domain within a short time window. The clustering logic may interpret this burst as a coordinated phishing campaign, especially if the alert emails contain similar HTML structures or links to dashboards.
  • Filter/Exclusion: Exclude clusters where the SenderDomain is in a predefined allowlist of internal monitoring tools (e.g., *.datadoghq.com, *.newrelic.com, *.pagerduty.com). Alternatively, filter out emails where the To field contains