Phish Detection IP and Geo Position

Hunt Hypothesis

This hypothesis targets adversaries leveraging T1566 Phishing to deliver malicious payloads, specifically identifying suspicious sender IP addresses and their geographic locations to uncover potential spoofing or infrastructure misconfigurations. Proactively hunting for these patterns in Azure Sentinel allows the SOC to correlate geographic anomalies with known threat actor regions, enabling early detection of phishing campaigns that may bypass standard content filters.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Phish" and isnotempty(SenderIPv4)
| summarize count() by SenderIPv4
| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)
| project SenderIPv4, Latitude, Longitude, ['Phish Emails'] = count_

Analytic Rule Definition

id: 06852891-b7b4-4e23-a97d-2ca4bb5c7ee9
name: Phish Detection IP and Geo Position
description: |
  This query summarises inbound email phishing detections by sender IP address with geographic coordinates for mapping.
description-detailed: |
  This query summarises inbound email phishing detections in Microsoft Defender for Office 365 by sender IPv4 address, resolving each IP to its geographic latitude and longitude using geo_info_from_ip_address so the sending infrastructure can be plotted on a map.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Phish" and isnotempty(SenderIPv4)
  | summarize count() by SenderIPv4
  | extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
  | extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)
  | project SenderIPv4, Latitude, Longitude, ['Phish Emails'] = count_
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Phish Detection IP and Geo Position.yaml)

False Positive Guidance

• Scenario: Automated transactional emails from SaaS platforms (e.g., Jira, Salesforce, or GitHub) sent via shared IP pools or CDN edge nodes that may have inconsistent or shifting geographic origins due to anycast routing.
  • Filter/Exclusion: Exclude sender domains associated with known SaaS providers (e.g., @github.com, @jira.com, @salesforce.com) or exclude IPs belonging to major cloud provider ranges (e.g., AWS, Azure, GCP) if the geo-location variance is within the same continent.
• Scenario: Internal monitoring agents or backup systems (e.g., Veeam, Commvault, or SolarWinds) sending status reports or alerts to distribution lists using the server’s public IP, which may be geographically distant from the primary office location if the infrastructure is hosted in a remote data center or cloud region.
  • Filter/Exclusion: Exclude specific internal service accounts or known backup/monitoring tool user agents (e.g., VeeamBackupServer, CommvaultClient) and whitelist IPs registered in the internal asset inventory as “Infrastructure” or “Cloud-Hosted.”
• Scenario: Marketing or newsletter campaigns sent via ESPs (Email Service Providers) like Mailchimp or SendGrid, where the sending IP rotates across multiple geographic locations to optimize deliverability, causing the same “sender” to appear from different continents on different days.
  • Filter/Exclusion: Exclude domains tagged as “Marketing” or “Newsletter” in the email gateway (e.g., @mailchimp.com, @sendgrid.net) or apply a time-based filter to ignore geo-variance for senders with high volume (>100 emails/hour) from the same domain.
• Scenario: Legacy on-premises servers sending scheduled job outputs (e.g., SQL Server Agent jobs, Cron jobs