← Back to SOC feed Coverage →

Phishing Detected by LLM Content Analysis

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficialphishing
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries leveraging sophisticated, AI-generated phishing content that evades traditional signature-based detection, as identified by Microsoft Defender for Office 365’s LLM analysis. Proactively hunting for these events allows the SOC to identify high-fidelity social engineering attempts early, reducing the risk of credential theft or malware delivery before user interaction occurs.

KQL Query

// OrgLevelPolicy exclusions drop phishing-simulation and SecOps-mailbox deliveries; remove them to include those.
EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Phish" and tostring(DetectionMethods) has "LLM content analysis"
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, DetectionMethods, NetworkMessageId
| top 100 by Timestamp desc

Analytic Rule Definition

id: cf9cbcb0-5b9d-4054-8342-c47168ea50c6
name: Phishing Detected by LLM Content Analysis
description: |
  This query lists inbound phishing messages that Microsoft Defender for Office 365 detected using LLM (Language AI) content analysis, using the EmailEvents table.
description-detailed: |
  Microsoft Defender for Office 365 uses Language AI (LLM) content analysis to detect phishing and business email compromise from the content of a message. This query lists the most recent inbound emails classified as Phish where LLM content analysis contributed to the detection, so analysts can see what this newer detection method is catching and triage the messages.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // OrgLevelPolicy exclusions drop phishing-simulation and SecOps-mailbox deliveries; remove them to include those.
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Phish" and tostring(DetectionMethods) has "LLM content analysis"
  | project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, DetectionMethods, NetworkMessageId
  | top 100 by Timestamp desc
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Phishing Detected by LLM Content Analysis.yaml