Phish Detections by Threat Classification

Hunt Hypothesis

This hypothesis targets adversaries leveraging T1566 to deliver phishing payloads, specifically identifying inbound emails classified by Microsoft Defender for Office 365 LLM content analysis as high-risk intents such as invoice or gift requests. Proactively hunting for these detections allows the SOC to isolate and investigate suspicious communications before users interact with them, thereby reducing the likelihood of credential theft or malware execution within the Azure Sentinel environment.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Phish" and ThreatClassification has_any("Business intelligence","Contact establishment","Gift card","Invoice","Payroll","PII gathering","Task")
| summarize Count = count() by ThreatClassification
| sort by Count desc
| render piechart

Analytic Rule Definition

id: a636bbbd-c6d0-4319-ae10-a06e809ba18f
name: Phish Detections by Threat Classification
description: |
  This query summarises inbound email phishing detections grouped by the message-intent threat classification produced by Microsoft Defender for Office 365 LLM content analysis (for example Invoice, Gift card, Payroll, PII gathering).
description-detailed: |
  Microsoft Defender for Office 365 uses LLM content analysis to classify the intent of phishing messages, and these threat classifications are used in filtering decisions. This query summarises inbound phishing detections grouped by that intent classification (for example Business intelligence, Contact establishment, Gift card, Invoice, Payroll, PII gathering, Task).
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Phish" and ThreatClassification has_any("Business intelligence","Contact establishment","Gift card","Invoice","Payroll","PII gathering","Task")
  | summarize Count = count() by ThreatClassification
  | sort by Count desc
  | render piechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Phish Detections by Threat Classification.yaml)

False Positive Guidance

• Legitimate Invoice Automation via ERP Integrations: Many enterprise Resource Planning (ERP) systems (e.g., SAP, Oracle NetSuite) or accounting software (e.g., QuickBooks, Xero) send automated transactional emails with subject lines and body text that closely mimic phishing “invoice” or “payment due” classifications. The LLM may classify these as high-risk “Invoice” phish due to urgency language or attachment types (PDF).

  • Filter/Exclusion: Exclude messages where the Sender is a verified internal domain or known vendor IP range, and where the MessageIntent is “Invoice” but the HasAttachment is true and the AttachmentType is application/pdf from a trusted sender list.

• Scheduled Marketing or Newsletter Campaigns: Marketing automation platforms (e.g., HubSpot, Marketo, Mailchimp) often send bulk emails with promotional content that includes images (GIFs) and call-to-action links. If the campaign uses generic language or includes a GIF banner, the LLM may misclassify it as a “Gif” or “Phish” intent, especially if the email is sent from a shared mailbox or a subdomain not fully whitelisted.

  • Filter/Exclusion: Exclude messages where the Sender matches a known marketing domain (e.g., *.hubspot.net, *.marketo.com) and the MessageIntent is “Gif” or “Promotional”, provided the RecipientCount is greater than 50 (indicating a broadcast rather than a targeted phish).

• Internal IT Ticketing System Notifications: IT service management tools (e.g., ServiceNow, Jira, Zendesk) send automated notifications for ticket updates, often including links to the ticket and sometimes embedded images or status icons. These emails can be misclassified as “Phish” if the LLM interprets