Top Recipients Receiving Threats Delivered by Override

Hunt Hypothesis

This hypothesis targets adversaries who exploit administrative or user overrides to bypass automated threat protection, a common tactic in targeted phishing campaigns (T1566) where malicious emails are manually released despite detection alerts. Proactively hunting for these top recipients helps the SOC identify high-value targets or compromised accounts that are consistently receiving overridden threats, enabling rapid investigation into potential insider threats or successful spear-phishing incidents.

KQL Query

// Recipients with the most threats delivered via an admin or user override, with the override share and type breakdown.
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend OverrideType = case(
    OrgLevelAction == "Allow" and OrgLevelPolicy != "" and OrgLevelPolicy != "SecOps Mailbox", OrgLevelPolicy,
    UserLevelAction == "Allow", strcat("User: ", UserLevelPolicy),
    "(none)")
| summarize PerType = count() by RecipientEmailAddress, OverrideType
| summarize TotalThreats = sum(PerType),
            OverriddenThreats = sumif(PerType, OverrideType != "(none)"),
            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, " (", PerType, ")"), OverrideType != "(none)"), "; ")
        by RecipientEmailAddress
| where OverriddenThreats > 0
| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)
| top 15 by OverriddenThreats
| project Recipient = RecipientEmailAddress, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes

Analytic Rule Definition

id: 6b92522d-8e82-4fd2-ae70-3f1bc4846909
name: Top Recipients Receiving Threats Delivered by Override
description: |
  This query lists the recipients who received the most threats that were delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table.
description-detailed: |
  Threats delivered because of an admin or user override (allow policies, safe-sender lists, Exchange transport rules, quarantine release) bypass Microsoft Defender for Office 365 protection and reach the user. This query ranks the recipients with the most overridden threats, showing the total threats they received, how many were delivered via an override, the override percentage, and which override types were responsible. A high override rate on a mailbox warrants a policy review.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Recipients with the most threats delivered via an admin or user override, with the override share and type breakdown.
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend OverrideType = case(
      OrgLevelAction == "Allow" and OrgLevelPolicy != "" and OrgLevelPolicy != "SecOps Mailbox", OrgLevelPolicy,
      UserLevelAction == "Allow", strcat("User: ", UserLevelPolicy),
      "(none)")
  | summarize PerType = count() by RecipientEmailAddress, OverrideType
  | summarize TotalThreats = sum(PerType),
              OverriddenThreats = sumif(PerType, OverrideType != "(none)"),
              OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, " (", PerType, ")"), OverrideType != "(none)"), "; ")
          by RecipientEmailAddress
  | where OverriddenThreats > 0
  | extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)
  | top 15 by OverriddenThreats
  | project Recipient = RecipientEmailAddress, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Overrides/Top Recipients Receiving Threats Delivered by Override.yaml)

False Positive Guidance

• Scenario: Security Team Testing Phishing Campaigns with Bypass

  • Context: The Security Operations Center (SOC) or Phishing Prevention team conducts quarterly simulated phishing campaigns. To ensure the emails reach specific test users (e.g., new hires or high-risk departments) despite strict gateway policies, they use the “Override” feature in the Exchange Admin Center or Microsoft 365 Defender portal to deliver messages that would otherwise be quarantined.
  • Filter/Exclusion: Exclude recipients whose primary SMTP domain matches the internal security team’s alias (e.g., security-ops@company.com) or exclude messages where the OverrideType is AdminOverride and the Sender is a known security service account (e.g., svc-phishing-sim@company.com).

• Scenario: IT Helpdesk Manually Releasing Quarantined Business-Critical Emails

  • Context: The IT Service Desk receives tickets from users stating that important vendor invoices or client contracts were blocked by the email security gateway. Agents use the “Override” feature to manually release these specific messages to the user’s inbox to resolve the ticket, often for high-priority or time-sensitive business communications.
  • Filter/Exclusion: Exclude recipients who are members of the IT-Helpdesk-Recipients distribution group or exclude messages where the OverrideType is UserOverride and the Subject contains keywords like “Invoice,” “Contract,” or “Urgent” (if subject-based filtering is available in the data model).

• Scenario: Automated Scheduled Jobs for System Notifications

  • Context: Internal monitoring tools (e.g., Datadog, Splunk, or custom Python scripts) send automated alert notifications via SMTP to a shared mailbox (e.g., alerts@company.com). If the gateway flags these due to high volume or specific