Top Sender Domains Delivering Threats via Override

Hunt Hypothesis

This hypothesis targets adversaries leveraging social engineering to bypass automated email security controls by inducing users or administrators to override threat detections, a common tactic in targeted phishing campaigns (T1566). Proactively hunting for this behavior in Azure Sentinel allows the SOC to identify specific sender domains with high override rates, revealing potential blind spots in user training or policy enforcement that could lead to successful initial access.

KQL Query

// Sender domains with the most threats delivered via an admin or user override, with the override share and type breakdown.
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend OverrideType = case(
    OrgLevelAction == "Allow" and OrgLevelPolicy != "" and OrgLevelPolicy != "SecOps Mailbox", OrgLevelPolicy,
    UserLevelAction == "Allow", strcat("User: ", UserLevelPolicy),
    "(none)")
| summarize PerType = count() by SenderFromDomain, OverrideType
| summarize TotalThreats = sum(PerType),
            OverriddenThreats = sumif(PerType, OverrideType != "(none)"),
            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, " (", PerType, ")"), OverrideType != "(none)"), "; ")
        by SenderFromDomain
| where OverriddenThreats > 0
| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)
| top 10 by OverriddenThreats
| project SenderDomain = SenderFromDomain, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes

Analytic Rule Definition

id: 8c2aeb94-ecd0-4b14-ad8c-a6e2986f6b50
name: Top Sender Domains Delivering Threats via Override
description: |
  This query lists the sender domains whose threats were most often delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table.
description-detailed: |
  A sender domain with a high share of its threats delivered because of an admin or user override (allow policies, safe-sender lists, Exchange transport rules, quarantine release) is bypassing Microsoft Defender for Office 365 protection. This query ranks sender domains by the number of threats delivered via an override, showing the total threats, the overridden count, the override percentage, and which override types were responsible. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Sender domains with the most threats delivered via an admin or user override, with the override share and type breakdown.
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and isnotempty(ThreatTypes) and OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend OverrideType = case(
      OrgLevelAction == "Allow" and OrgLevelPolicy != "" and OrgLevelPolicy != "SecOps Mailbox", OrgLevelPolicy,
      UserLevelAction == "Allow", strcat("User: ", UserLevelPolicy),
      "(none)")
  | summarize PerType = count() by SenderFromDomain, OverrideType
  | summarize TotalThreats = sum(PerType),
              OverriddenThreats = sumif(PerType, OverrideType != "(none)"),
              OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, " (", PerType, ")"), OverrideType != "(none)"), "; ")
          by SenderFromDomain
  | where OverriddenThreats > 0
  | extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)
  | top 10 by OverriddenThreats
  | project SenderDomain = SenderFromDomain, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Overrides/Top Sender Domains Delivering Threats via Override.yaml)

False Positive Guidance

• Scenario: A global IT administrator performs a bulk override on a large batch of emails from a known vendor (e.g., salesforce.com or workday.com) to unblock them after a temporary policy misconfiguration or during a system migration. This creates a high volume of “Admin Override” events for that specific domain, triggering the threshold for “Top Sender Domains.”

  • Filter/Exclusion: Exclude domains that are explicitly whitelisted in the organization’s sender policy or match against a list of known internal vendor domains. Alternatively, add a condition to exclude if the override type is exclusively “Admin Override” and the count of overridden emails is below a certain absolute threshold (e.g., < 50) to account for manual batch operations.

• Scenario: A user in the Finance department overrides a series of invoices from a new supplier (e.g., ap.invoice-provider.com) because the initial emails were flagged as “Phishing” due to a new domain registration or a missing DMARC record. The user, trusting the invoice content, manually overrides the threat for each email, creating a cluster of “User Override” events from that domain.

  • Filter/Exclusion: Correlate with the EmailMessage table to check if the overridden emails have a subject line containing keywords like “Invoice,” “Receipt,” or “Payment.” Exclude domains where the majority of overridden emails have a subject line matching these business-critical keywords, or exclude if the user’s role is in a predefined list of finance/procurement groups.

• Scenario: A scheduled PowerShell script or API job (e.g., using Microsoft Graph API) automatically processes incoming emails from a specific monitoring service (e.g., statuspage.io or newrelic.com) and programmatically overrides threats to ensure alerts are not blocked. This automated process generates a consistent, high-volume stream of “Admin Override” events