Quarantine Release Percentage

Hunt Hypothesis

This hypothesis targets potential phishing or spearphishing campaigns (T1566) where attackers craft convincing messages that bypass initial automated filters, leading to a high rate of user-initiated releases from quarantine. Proactively hunting for this anomaly in Azure Sentinel helps identify targeted attacks or compromised user judgment that standard threshold alerts might miss, ensuring timely investigation of suspicious email traffic.

KQL Query

let Quarantine_Releases = toscalar(EmailPostDeliveryEvents
| where Timestamp > ago(30d)
| where Action == "Quarantine release"
| distinct NetworkMessageId, RecipientEmailAddress
| count);
let Quarantined_Mailflow = toscalar(EmailEvents
| where Timestamp > ago(30d)
| where DeliveryLocation == "Quarantine"
| distinct NetworkMessageId, RecipientEmailAddress
| count);
print
Quarantine_Releases = toreal(Quarantine_Releases),
Quarantined_Mailflow = toreal(Quarantined_Mailflow),
Release_Percentage = iff(Quarantined_Mailflow == 0, 0.0, round((toreal(Quarantine_Releases) / toreal(Quarantined_Mailflow)) * 100, 2))

Analytic Rule Definition

id: 5fb333a4-39bb-474b-ab37-9efdca8e9182
name: Quarantine Release Percentage
description: |
  This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined.
description-detailed: |
  This query calculates the percentage of quarantined emails in Microsoft Defender for Office 365 that were subsequently released (EmailPostDeliveryEvents Action == "Quarantine release") out of the total quarantined (EmailEvents DeliveryLocation == "Quarantine"). The percentage is guarded against a zero denominator.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Quarantine_Releases = toscalar(EmailPostDeliveryEvents
  | where Timestamp > ago(30d)
  | where Action == "Quarantine release"
  | distinct NetworkMessageId, RecipientEmailAddress
  | count);
  let Quarantined_Mailflow = toscalar(EmailEvents
  | where Timestamp > ago(30d)
  | where DeliveryLocation == "Quarantine"
  | distinct NetworkMessageId, RecipientEmailAddress
  | count);
  print
  Quarantine_Releases = toreal(Quarantine_Releases),
  Quarantined_Mailflow = toreal(Quarantined_Mailflow),
  Release_Percentage = iff(Quarantined_Mailflow == 0, 0.0, round((toreal(Quarantine_Releases) / toreal(Quarantined_Mailflow)) * 100, 2))
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Quarantine/Quarantine Release Percentage.yaml)

False Positive Guidance

• Bulk Release by Exchange Online Admins via PowerShell

  • Scenario: An Exchange Online administrator executes a scheduled PowerShell script (e.g., using New-QuarantineRelease or Release-QuarantinedMessage) to batch-release legitimate newsletters or internal announcements that were incorrectly flagged by the anti-phishing policy. This creates a high volume of releases in a short window, skewing the percentage.
  • Filter/Exclusion: Exclude events where the Operation is “Release” and the UserAgent or ClientIP matches known admin service accounts (e.g., svc-exchange-admin, admin@domain.com) or specific PowerShell script names (e.g., DailyQuarantineCleanup.ps1).

• User Self-Service Release via Outlook Web App (OWA) or Outlook Client

  • Scenario: End-users with the “Release” permission (often granted to helpdesk staff or power users) manually release individual messages from their “Quarantine” folder in OWA or the Outlook desktop client. If multiple users release messages simultaneously during a business day, this can trigger a spike in release activity.
  • Filter/Exclusion: Filter out releases where the Source is “User” or “OWA” and the MessageCount per user in the aggregation window is below a defined threshold (e.g., < 5 messages per user per hour).

• Conditional Access or DLP Policy Exemptions

  • Scenario: A Data Loss Prevention (DLP) or Conditional Access policy is updated to exempt specific domains or file types from quarantine. When these policies are active, new messages that would have been quarantined are instead released automatically by the transport pipeline, appearing as “releases” in audit logs if the rule logic conflates “not quarantined” with “released from quarantine.”