Top accounts performing user submissions (FP)

Hunt Hypothesis

This rule identifies accounts with a high volume of false positive submissions, which may indicate an adversary using T1566 (Phishing) to test email gateway filters or a compromised account generating noise to obscure malicious activity. Proactively hunting for this behavior allows the SOC to distinguish between legitimate user error and targeted phishing campaigns or credential abuse before they result in a successful breach.

KQL Query

CloudAppEvents
| where ActionType == "UserSubmission"
| extend RawData = parse_json(RawEventData)
| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), UserId = tostring(RawData.UserId)
| where RecordType == 29 and SubmissionType == "3"
| summarize count() by UserId
| top 15 by count_
| render piechart

Analytic Rule Definition

id: fa0ce1b0-59fa-4fea-87e8-6752951cec3f
name: Top accounts performing user submissions (FP)
description: |
  This query visualises the top accounts performing user false positive submissions.
description-detailed: |
  This query visualises the top accounts performing user false positive submissions.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend RawData = parse_json(RawEventData)
  | extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), UserId = tostring(RawData.UserId)
  | where RecordType == 29 and SubmissionType == "3"
  | summarize count() by UserId
  | top 15 by count_
  | render piechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/Top accounts performing user submissions - FP.yaml)

False Positive Guidance

• Service Account API Polling: A dedicated service account (e.g., svc-crm-integration) used by a CRM or ERP system (like Salesforce or SAP) that makes high-frequency GET or POST requests to the API gateway for data synchronization. This legitimate automated traffic often lacks a human-like User-Agent or session context, triggering “user submission” heuristics.
  • Filter: Exclude accounts with names matching svc-* or api-* patterns, or filter out requests where the User-Agent header contains python-requests, axios, or specific SDK identifiers (e.g., Salesforce-SDK).
• Scheduled CI/CD Pipeline Webhooks: A build automation tool (e.g., Jenkins, GitHub Actions, or GitLab CI) configured to trigger deployment hooks or status updates via HTTP POST to an internal webhook endpoint. These jobs run on a fixed schedule (e.g., every 15 minutes) and use a static, non-interactive token, causing the system to log them as high-volume “user” submissions.
  • Filter: Exclude submissions originating from known CI/CD IP ranges or accounts tagged with ci-cd in the identity provider, and filter out requests where the Authorization header uses a Bearer token associated with a machine identity rather than a user session.
• Health Check and Monitoring Agents: Infrastructure monitoring tools (e.g., Datadog, New Relic, or Prometheus) or load balancer health checkers (e.g., AWS ALB, Azure Load Balancer) that continuously ping endpoints to verify service availability. These requests are high-volume, repetitive, and often originate from internal IPs or specific monitoring accounts, mimicking the pattern of a user rapidly submitting forms or data.
  • Filter: Exclude accounts with names like monitoring-agent, health-checker, or `lb-probe