This hypothesis identifies users who are disproportionately targeted by phishing campaigns leveraging spoofed sender addresses or social engineering tactics, indicating a likely focus on high-value assets or compromised credentials. Proactively hunting for these patterns allows the SOC to prioritize MFA enforcement and user awareness training for at-risk individuals before an initial access attempt succeeds.
// Recipients most targeted by impersonation / BEC, with distinct senders, a sample of sender domains and inbox delivery.
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
| where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
| where DetectionMethods has "Impersonation"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| summarize ImpersonationEmails = count(), DistinctSenders = dcount(SenderFromAddress), SampleSenderDomains = make_set(SenderFromDomain, 5), DeliveredToInbox = countif(DeliveryLocation has "Inbox") by RecipientEmailAddress
| top 20 by ImpersonationEmails
| project Recipient = RecipientEmailAddress, ImpersonationEmails, DistinctSenders, SampleSenderDomains = strcat_array(SampleSenderDomains, ", "), DeliveredToInbox
id: 7a8e34a4-3fbf-4ab6-a9d9-aa57c9267327
name: Top Recipients Targeted by Impersonation or BEC
description: |
This query lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, using the EmailEvents table.
description-detailed: |
Impersonation and Business Email Compromise (BEC) attacks concentrate on a small number of high-value recipients, often executives or finance staff. This query lists the inbound recipients most targeted by impersonation detections, with the number of impersonation emails, how many distinct senders were involved, a sample of the sender domains involved, and how many messages were delivered to the inbox. Use it to identify high-risk users who may need extra protection or awareness.
This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
// Recipients most targeted by impersonation / BEC, with distinct senders, a sample of sender domains and inbox delivery.
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
| where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
| where DetectionMethods has "Impersonation"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| summarize ImpersonationEmails = count(), DistinctSenders = dcount(SenderFromAddress), SampleSenderDomains = make_set(SenderFromDomain, 5), DeliveredToInbox = countif(DeliveryLocation has "Inbox") by RecipientEmailAddress
| top 20 by ImpersonationEmails
| project Recipient = RecipientEmailAddress, ImpersonationEmails, DistinctSenders, SampleSenderDomains = strcat_array(SampleSenderDomains, ", "), DeliveredToInbox
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
EmailEvents | Ensure this data connector is enabled |
Mass Email Distribution via Marketing Automation Tools: When enterprise marketing platforms (e.g., Marketo, HubSpot, or Mailchimp) send large-scale campaign emails, the system account or service principal used to dispatch these messages may be flagged as a “top recipient” if the detection logic incorrectly aggregates inbound headers or if the service account is the source of high-volume outbound traffic that gets correlated with impersonation heuristics.
*@marketing-automation.com, service-principal-marketing@domain.com) or filter out events where the MessageDirection is Outbound and the sender is a known automation service ID.Automated Ticketing System Notifications: IT service management tools (e.g., ServiceNow, Jira, or Zendesk) automatically generate high volumes of status update emails to distribution lists or specific user inboxes. If the detection rule counts “recipients” based on frequency without distinguishing between human users and automated notification endpoints, these system-generated emails can skew the top recipients list.
no-reply@domain.com, it-support@domain.com, jira-notifications@domain.com) or filter events where the Subject matches known automated patterns (e.g., “Ticket #”, “Status Update”, “Jira Notification”).Scheduled Report Generation by BI Tools: Business Intelligence platforms (e.g., Power BI, Tableau, or Qlik) often schedule automated report deliveries to key stakeholders or distribution groups. These scheduled jobs result in consistent, high-frequency email events to the same set of recipients, which can trigger a “top targeted” alert if the rule interprets high volume as a sign of targeted impersonation.