SecOps Mailbox Overrides by Threat Type

Hunt Hypothesis

This hypothesis targets adversaries leveraging T1566 (Phishing) to deliver malicious payloads to the SecOps mailbox by exploiting organization-level allow overrides that bypass standard filtering controls. Proactively hunting for this behavior is critical because the SecOps mailbox is a high-value target for threat actors seeking to compromise security operations, and identifying anomalous threat types in overridden emails helps detect sophisticated phishing campaigns that evade standard defenses.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where OrgLevelPolicy == "SecOps Mailbox" and OrgLevelAction == "Allow"
| extend ThreatType = case(ThreatTypes has "Malware", "Malware", ThreatTypes has "Phish", "Phish", ThreatTypes has "Spam", "Spam", ThreatTypes)
| summarize TotalEmails = count() by OrgLevelAction, OrgLevelPolicy, ThreatType
| sort by TotalEmails desc
| project ['Override Action'] = OrgLevelAction, ['Override Policy'] = OrgLevelPolicy, ['Threat Type'] = ThreatType, ['Total Emails'] = TotalEmails

Analytic Rule Definition

id: d234d85d-1dd5-433b-a984-0fd764f25363
name: SecOps Mailbox Overrides by Threat Type
description: |
  This query breaks down inbound emails delivered to the SecOps mailbox by an organisation-level allow override, grouped by threat type.
description-detailed: |
  This query breaks down inbound emails delivered to the SecOps mailbox in Microsoft Defender for Office 365 as a result of an organisation-level allow override (OrgLevelPolicy == "SecOps Mailbox" and OrgLevelAction == "Allow"), grouped by threat type (Malware, Phish, Spam). Messages are de-duplicated to the latest record per NetworkMessageId and recipient.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where OrgLevelPolicy == "SecOps Mailbox" and OrgLevelAction == "Allow"
  | extend ThreatType = case(ThreatTypes has "Malware", "Malware", ThreatTypes has "Phish", "Phish", ThreatTypes has "Spam", "Spam", ThreatTypes)
  | summarize TotalEmails = count() by OrgLevelAction, OrgLevelPolicy, ThreatType
  | sort by TotalEmails desc
  | project ['Override Action'] = OrgLevelAction, ['Override Policy'] = OrgLevelPolicy, ['Threat Type'] = ThreatType, ['Total Emails'] = TotalEmails
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Overrides/SecOps Mailbox Overrides by Threat Type.yaml)

False Positive Guidance

• Scenario: Automated vulnerability scanning tools (e.g., Qualys, Tenable) or security monitoring agents (e.g., SentinelOne, CrowdStrike) send daily/weekly summary reports or alert notifications directly to the SecOps distribution list.
  • Filter/Exclusion: Exclude emails where the SenderAddress matches known scanner domains (e.g., @qualys.com, @tenable.com) or where the Subject contains specific keywords like “Scan Report,” “Daily Summary,” or “Alert Notification.”
• Scenario: IT Service Management (ITSM) platforms (e.g., ServiceNow, Jira Service Management) automatically create tickets for new security incidents and send “Ticket Created” or “Status Updated” notifications to the SecOps mailbox.
  • Filter/Exclusion: Exclude emails where the SenderAddress matches ITSM domains (e.g., @service-now.com, @jira.com) or where the Subject starts with “Ticket #” or contains “Status Updated.”
• Scenario: Backup and Disaster Recovery solutions (e.g., Veeam, Commvault) send scheduled job completion or failure reports to the SecOps team for audit compliance, often including log snippets that may trigger threat detection heuristics.
  • Filter/Exclusion: Exclude emails where the SenderAddress matches backup vendor domains (e.g., @veeam.com, @commvault.com) or where the Subject contains “Job Completed,” “Backup Report,” or “DR Alert.”
• Scenario: Continuous Integration/Continuous Deployment (CI/CD) pipelines (e.g., GitHub Actions, Azure DevOps) send build success/failure or security scan (e.g., SAST/DAST) results to the SecOps mailbox for manual review.
  • Filter/Exclusion: Exclude emails where the SenderAddress matches