New External Sender Domains Carrying Threats

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing (T1566) by introducing new external sender domains that immediately carry malicious payloads, a tactic often used to bypass established allowlists or reputation checks. Proactively hunting for these first-seen domains in Azure Sentinel allows the SOC team to identify potential supply chain or spoofing attacks early, before they propagate across the organization and lead to credential theft or malware execution.

KQL Query

// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.
// let ExcludeDomains = dynamic(["contoso.com", "fabrikam.com"]);
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and isnotempty(SenderFromAddress)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])
// | where SenderDomain !in~ (ExcludeDomains)
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Messages = count(), Senders = dcount(SenderFromAddress), Recipients = dcount(RecipientEmailAddress), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderDomain
| where ThreatMessages > 0
| top 20 by FirstSeen desc
| project SenderDomain, FirstSeen, Messages, Senders, Recipients, ThreatMessages, LastSeen

Analytic Rule Definition

id: 12f223d9-ff72-4a6d-b60b-c59eacfaa89e
name: New External Sender Domains Carrying Threats
description: |
  This query lists external sender domains seen for the first time in the period that already carried threats, using the EmailEvents table.
description-detailed: |
  A brand-new sender domain that already arrives carrying threats is a strong early-warning signal for phishing and business email compromise (BEC). This query lists inbound external sender domains ordered by when they were first seen in the period, keeping only those that carried at least one threat, with message, sender, recipient and threat counts. Treat brand-new domains sending threats as high-priority review.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.
  // let ExcludeDomains = dynamic(["contoso.com", "fabrikam.com"]);
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and isnotempty(SenderFromAddress)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])
  // | where SenderDomain !in~ (ExcludeDomains)
  | summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Messages = count(), Senders = dcount(SenderFromAddress), Recipients = dcount(RecipientEmailAddress), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderDomain
  | where ThreatMessages > 0
  | top 20 by FirstSeen desc
  | project SenderDomain, FirstSeen, Messages, Senders, Recipients, ThreatMessages, LastSeen
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/New External Sender Domains Carrying Threats.yaml)

False Positive Guidance

• Scenario: A new vendor onboards and sends a bulk notification email (e.g., from billing@newvendor-saas.com) that includes a PDF attachment containing a known but low-severity macro or a link to a trusted SSO portal. If the email gateway or EDR flags the PDF as “Suspicious” due to a generic heuristic, the domain appears as a “new external sender carrying threats.”

  • Filter/Exclusion: Exclude domains where the threat type is limited to “Macro” or “Suspicious Link” and the sender is in the approved vendor list. Alternatively, exclude if the message has a MessageDirection: Outbound (if the rule is misconfigured to catch replies) or if the Sender domain matches a known SaaS provider list (e.g., zendesk.com, service-now.com).

• Scenario: An IT administrator performs a test of the new email security gateway by sending a test email from a temporary external domain (e.g., test@temp-mail-provider.com) that intentionally includes a canary token or a known benign exploit file to verify detection capabilities. This creates a “new domain” with a “threat” in the logs.

  • Filter/Exclusion: Exclude senders whose Sender address contains keywords like test, canary, verify, or qa in the local part of the email address. Additionally, exclude messages where the Subject line contains [TEST] or [QA].

• Scenario: A marketing team sends a newsletter from a new external email service provider (e.g., mailchimp.com or hubspot.com) to a large distribution list. If the newsletter contains a complex HTML structure or a tracking pixel that the email security appliance misclassifies as a “Phishing” or “Suspicious Content” threat, the domain is flagged as new and threatening.