Spam Detections by Sender Country

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) that originate from specific geographic regions to bypass initial email filters or exploit trust in certain sender locations. Proactively hunting for these patterns in Azure Sentinel allows the SOC to identify emerging spam trends or targeted phishing waves that may indicate broader compromise attempts before they result in user interaction.

KQL Query

// Inbound spam detections by sender-IP country. Country is from IP geolocation and is approximate.
EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| where ThreatTypes has "Spam" and isnotempty(SenderIPv4)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)
| where isnotempty(Country)
| summarize SpamEmails = count(), SenderIPs = dcount(SenderIPv4) by Country
| top 20 by SpamEmails
| project Country, SpamEmails, SenderIPs

Analytic Rule Definition

id: bdd60985-c235-4c74-af19-a3d77360f527
name: Spam Detections by Sender Country
description: |
  This query summarizes inbound spam detections by the geographic country of the sending IP address, using the EmailEvents table.
description-detailed: |
  Mapping spam detections to the country of the sending IP address helps identify the regions and sending infrastructure behind bulk and spam campaigns. This query resolves the sender IPv4 address to a country and counts inbound spam detections per country, with the number of distinct sending IPs. Country is derived from IP geolocation and is approximate.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Inbound spam detections by sender-IP country. Country is from IP geolocation and is approximate.
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | where ThreatTypes has "Spam" and isnotempty(SenderIPv4)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)
  | where isnotempty(Country)
  | summarize SpamEmails = count(), SenderIPs = dcount(SenderIPv4) by Country
  | top 20 by SpamEmails
  | project Country, SpamEmails, SenderIPs
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spam/Spam Detections by Sender Country.yaml)

False Positive Guidance

• Legitimate International Partner Communications: Employees frequently exchange emails with global partners, vendors, or clients located in countries that are statistically higher-risk for spam (e.g., China, India, Brazil, or Russia). If the detection rule flags all spam events from these countries, it will generate noise for legitimate business correspondence that may have been misclassified by the spam filter or contains attachments that triggered heuristics.

  • Filter/Exclusion: Exclude email events where the SenderDomain is on the organization’s approved external partner domain list, or where the MessageDirection is ‘Inbound’ and the SenderCountry matches a predefined list of trusted business partner countries.

• Marketing and Newsletter Subscriptions: Users often subscribe to industry newsletters, product updates, or marketing communications from global SaaS providers (e.g., AWS, Azure, GitHub, or Salesforce) that may send emails from data centers located in various countries. These emails are often categorized as “Spam” or “Junk” by the email gateway due to high volume or specific headers, triggering the rule.

  • Filter/Exclusion: Exclude events where the SenderDomain ends with known major SaaS or cloud provider domains (e.g., @aws.com, @azure.com, @github.com, @salesforce.com) or where the Subject contains keywords like “Newsletter”, “Update”, or “Receipt”.

• Automated System Notifications and Alerts: Internal or external monitoring tools (e.g., PagerDuty, Datadog, New Relic, or Jira) send automated alerts to distribution lists. These services often use rotating IP addresses or cloud infrastructure located in different countries. If the spam filter misidentifies these high-volume, template-based emails as spam, they will appear in the EmailEvents table with a Spam category.

  • **Filter/Ex