User Email Submission Trend (FP)

Hunt Hypothesis

This rule identifies anomalous spikes in user-reported false positive emails, which can signal an adversary leveraging T1566 (Phishing) to blend malicious messages with legitimate traffic or to test email filtering mechanisms. Proactively hunting for this trend allows the SOC to distinguish between routine user noise and targeted phishing campaigns that are evading automated detection, ensuring timely investigation of potential initial access vectors.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
CloudAppEvents
| where Timestamp >= TimeStart and Timestamp < TimeEnd
| where ActionType == "UserSubmission"
| extend RawData = parse_json(RawEventData)
| where tostring(RawData.SubmissionType) == "3" and tostring(RawData.SubmissionContentType) == "Mail"
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "User_Email_FP"
| project Count, Details, Timestamp
| render timechart

Analytic Rule Definition

id: 98ed7471-ce5e-4d48-b9f9-dae4cf045b3e
name: User Email Submission Trend (FP)
description: |
  This query visualises the daily amount of user false positive email submissions over time.
description-detailed: |
  This query visualises the daily amount of user false positive email submissions over time.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  CloudAppEvents
  | where Timestamp >= TimeStart and Timestamp < TimeEnd
  | where ActionType == "UserSubmission"
  | extend RawData = parse_json(RawEventData)
  | where tostring(RawData.SubmissionType) == "3" and tostring(RawData.SubmissionContentType) == "Mail"
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "User_Email_FP"
  | project Count, Details, Timestamp
  | render timechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions Trend - FP.yaml)

False Positive Guidance

• Scenario: A security operations team conducts a scheduled phishing simulation campaign using a tool like GoPhish or KnowBe4, where multiple users intentionally click links or submit emails to test awareness.
  • Filter/Exclusion: Exclude submissions where the sender_domain matches the internal simulation domain (e.g., phish-sim.internal) or where the submission_source tag is set to phishing_simulation.
• Scenario: An IT administrator performs a bulk email migration or testing of a new mail gateway rule, resulting in a spike of test emails being submitted by service accounts or a specific admin user.
  • Filter/Exclusion: Exclude submissions where the submitter_account is a known service account (e.g., svc-mail-migration) or where the email_subject contains specific test markers like [TEST] or QA-Validation.
• Scenario: A new onboarding batch of employees uses a standardized welcome email template that includes a “reply to confirm” action, causing a cluster of legitimate user submissions on the same day.
  • Filter/Exclusion: Exclude submissions where the email_subject matches the known onboarding template subject line (e.g., “Welcome to [Company] - Please Confirm”) and the sender_domain is the internal HR domain.
• Scenario: A scheduled automated job (e.g., via PowerShell or a Python script) sends verification emails to a distribution list for system health checks, which are then submitted by users who forward them to the security inbox.
  • Filter/Exclusion: Exclude submissions where the email_headers contain a specific X-Source header value (e.g., X-Source: AutoHealthCheck) or where the submitter_account is associated with the automated job’s service principal.
• Scenario: A user group (e.g., the