Top Attacked Users by Malware Threat Classification

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing (T1566) to deliver malware by identifying high-value recipients who are disproportionately targeted across specific malware classifications. Proactively hunting for these patterns allows the SOC to prioritize defensive measures for users who are likely being used as initial access vectors or are experiencing targeted spear-phishing campaigns before they lead to broader compromise.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Malware" and EmailDirection == "Inbound" and ThreatClassification has_any("Adware","Downloader","HackTool","Ransomware","Remote access trojan","Spyware")
| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress
| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification
| sort by Count desc
| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count

Analytic Rule Definition

id: 177b756b-03f1-4107-a547-92872ba32c47
name: Top Attacked Users by Malware Threat Classification
description: |
  This query surfaces, for each malware threat classification, the recipient most frequently targeted by inbound malware email.
description-detailed: |
  This query surfaces, for each malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware), the recipient most frequently targeted by inbound malware email in Microsoft Defender for Office 365.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Malware" and EmailDirection == "Inbound" and ThreatClassification has_any("Adware","Downloader","HackTool","Ransomware","Remote access trojan","Spyware")
  | summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress
  | summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification
  | sort by Count desc
  | project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Top Attacked Users by Malware Threat Classification.yaml)

False Positive Guidance

• Shared Mailbox for IT Helpdesk/Service Desk: The “IT-Support” shared mailbox is a high-traffic recipient for inbound emails containing attachments (e.g., PDFs, Excel sheets) from various vendors and users. Since this mailbox aggregates traffic from many senders, it naturally becomes the top recipient for specific malware classifications (like Trojan.Generic or Phishing) due to volume, not necessarily because it is the primary target of a coordinated attack.

  • Filter/Exclusion: Exclude recipients where RecipientTypeDetails is “SharedMailbox” or where the MailboxType is “Shared”. Alternatively, filter out recipients whose name matches common service account patterns (e.g., *helpdesk*, *support*, *it*).

• Automated Invoice Processing Pipeline: A finance department uses a dedicated mailbox (e.g., accounts-payable@corp.com) that receives automated emails from ERP systems (e.g., SAP, Oracle NetSuite) or payment gateways. These emails often contain PDF or Excel attachments that may be misclassified by the mail gateway as low-fidelity malware (e.g., Macro Virus or Generic Trojan) due to embedded scripts or digital signatures, causing this single recipient to dominate the “Top Attacked Users” list for those classifications.

  • Filter/Exclusion: Exclude recipients that are known financial processing mailboxes (e.g., *accounts*, *ap@*, *invoices*). Additionally, consider excluding messages where the MessageClass indicates an automated system sender or where the SenderDomain matches known internal ERP domains.

• Marketing Campaigns with Embedded Trackers: The marketing team sends large-scale outbound campaigns, but also receives inbound responses or automated bounces that include tracking pixels or lightweight scripts. If the mail gateway’s malware engine flags these as Phishing or `