Phish Detections by Sender Country

Hunt Hypothesis

This hypothesis targets adversaries leveraging geographically inconsistent or high-risk sender countries to bypass user suspicion and deliver phishing payloads, aligning with MITRE technique T1566. Proactively hunting for these patterns in Azure Sentinel allows the SOC to identify systemic gaps in email filtering or user awareness that may be exploited for initial access, even if individual alerts are triaged as low severity.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Phish" and isnotempty(SenderIPv4)
| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
| extend Country = tostring(GeoInfo.country)
| summarize count() by Country
| project Country, ['Phish Emails'] = count_
| sort by ['Phish Emails'] desc

Analytic Rule Definition

id: b47d1de3-041a-406b-9d99-ffc7749b00f2
name: Phish Detections by Sender Country
description: |
  This query summarises inbound email phishing detections by the sender IP address country, derived from the sender IPv4 address.
description-detailed: |
  This query summarises inbound email phishing detections in Microsoft Defender for Office 365 by the sender IP address country, derived from the sender IPv4 address using geo_info_from_ip_address.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Phish" and isnotempty(SenderIPv4)
  | extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
  | extend Country = tostring(GeoInfo.country)
  | summarize count() by Country
  | project Country, ['Phish Emails'] = count_
  | sort by ['Phish Emails'] desc
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Phish Detections by Sender Country.yaml)

False Positive Guidance

• Scenario: Automated notifications from cloud infrastructure or SaaS platforms (e.g., AWS CloudWatch, Azure Monitor, or Slack) where the sending IP is geolocated in a region different from the user’s primary location due to global load balancing or CDN usage.

  • Filter/Exclusion: Exclude known service account email addresses (e.g., no-reply@aws.amazon.com, alerts@azure.com) or specific sender domains associated with internal SaaS tools in the SenderDomain field.

• Scenario: Scheduled reports or job completion alerts from on-premises or hybrid servers (e.g., SQL Server Agent jobs, Jenkins CI/CD pipelines, or Ansible Tower) that route through a shared outbound mail relay located in a different country than the end-user’s workstation.

  • Filter/Exclusion: Create a dynamic list of internal relay server IPs or hostnames (e.g., mail-relay-01.corp.local) and exclude events where the SenderIP matches this list, or filter out emails with subject lines containing standard report keywords like “Daily Report” or “Job Completed”.

• Scenario: Multi-factor authentication (MFA) or password reset emails from identity providers (e.g., Okta, Azure AD, or OneLogin) that are generated by a global edge node, causing the sender IP country to appear as a non-local region (e.g., a user in Germany receiving an MFA code from a US-based edge node).

  • Filter/Exclusion: Exclude specific sender domains for major IdP services (e.g., @okta.com, @login.microsoftonline.com) or filter based on the MessageSubject containing “Verification Code” or “Password Reset”.

• Scenario: Inbound emails from international business partners or clients who are legitimately located in a different country, especially in industries with global supply chains or