Top Attacked Users by Phish Threat Classification

Hunt Hypothesis

This hypothesis targets the adversary behavior of phishing (T1566), where attackers selectively target high-value or frequently attacked users to maximize the likelihood of successful credential compromise or malware delivery. Proactively hunting for these top targeted recipients in Azure Sentinel allows the SOC to identify persistent targeting patterns and prioritize enhanced monitoring or user awareness training for individuals who are disproportionately exposed to phishing threats.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Phish" and EmailDirection == "Inbound" and ThreatClassification has_any("Business intelligence","Contact establishment","Gift card","Invoice","Payroll","PII gathering","Task")
| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress
| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification
| sort by Emails desc
| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails

Analytic Rule Definition

id: 6a5923be-81e4-496b-9ce3-f009a5f20737
name: Top Attacked Users by Phish Threat Classification
description: |
  This query surfaces, for each phishing message-intent threat classification, the recipient most frequently targeted by inbound phishing email.
description-detailed: |
  Microsoft Defender for Office 365 uses LLM content analysis to classify the intent of phishing messages. This query surfaces, for each intent classification (for example Business intelligence, Contact establishment, Gift card, Invoice, Payroll, PII gathering, Task), the recipient most frequently targeted by inbound phishing email.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Phish" and EmailDirection == "Inbound" and ThreatClassification has_any("Business intelligence","Contact establishment","Gift card","Invoice","Payroll","PII gathering","Task")
  | summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress
  | summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification
  | sort by Emails desc
  | project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Top Attacked Users by Phish Threat Classification.yaml)

False Positive Guidance

• Shared Mailbox for High-Volume Customer Support

  • Scenario: A shared mailbox (e.g., support@company.com) used by a large support team receives thousands of inbound emails daily. Since phishing classifiers often flag messages with specific linguistic patterns or sender reputation issues, this high-volume account will statistically appear as the “most targeted” user for classifications like “Spear Phishing” or “Generic Phishing,” even if the actual infection rate is low.
  • Filter/Exclusion: Exclude recipients where MailboxType is “Shared” or IsSharedMailbox is True. Alternatively, filter out users with a TotalMessagesReceived count above a defined threshold (e.g., >500 messages/day) to focus on individual user risk rather than aggregate shared inbox noise.

• Automated Notification and Alerting Systems

  • Scenario: Service accounts or distribution lists used for automated alerts (e.g., alerts@company.com, ci-cd-notifications@company.com) receive frequent emails from monitoring tools like Datadog, PagerDuty, or Jira. These automated messages may lack standard SPF/DKIM/DMARC alignment or use generic subject lines that trigger phishing heuristics, causing the system account to be flagged as a top target.
  • Filter/Exclusion: Exclude recipients associated with known service accounts by matching against a list of known system email addresses or filtering where SenderDomain matches internal infrastructure domains (e.g., *.datadoghq.com, *.pagerduty.com) and MessageIntent is classified as “Notification” or “Automated.”

• Newly Onboarded Users with High Inbound Traffic

  • Scenario: A new employee or contractor joins the organization and is immediately added to numerous distribution lists or receives a large volume of welcome packets, on