User Email Submissions (FN) - Top Intra-Org P2 Senders

Hunt Hypothesis

Adversaries may use intra-org email submissions to exfiltrate data or establish command and control channels by mimicking legitimate user behavior. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential data leakage or covert communication attempts leveraging internal email infrastructure.

KQL Query

CloudAppEvents 
| where ActionType == "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId
| extend User_SubmissionType=
iff(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Phish_FN",
iff(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Spam_FN","Other")),
NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
| where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
| join EmailEvents on NetworkMessageId, RecipientObjectId
| where EmailDirection == "Intra-org"
| summarize count() by SenderMailFromAddress
| project SenderMailFromAddress,UserSubmissions = count_
| top 10 by UserSubmissions desc

Analytic Rule Definition

id: 2adae71b-42b9-47b8-9cb7-ccea9fece3e2
name: User Email Submissions (FN) - Top Intra-Org P2 Senders
description: |
  This query visualises top sender email addresses of intra-org emails submitted as false negatives by users.
description-detailed: |
  This query visualises top sender email addresses of intra-org emails submitted as false negatives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId
  | extend User_SubmissionType=
  iff(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Phish_FN",
  iff(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Spam_FN","Other")),
  NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
  | where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
  | join EmailEvents on NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Intra-org"
  | summarize count() by SenderMailFromAddress
  | project SenderMailFromAddress,UserSubmissions = count_
  | top 10 by UserSubmissions desc
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders.yaml)

False Positive Guidance

• Scenario: Scheduled Backup Job Sending Emails
  Description: A scheduled backup job (e.g., using Veeam, Commvault, or Veritas) sends emails to internal recipients as part of its reporting or notification process.
  Filter/Exclusion: Exclude emails sent by known backup tools or services (e.g., sender = "backup@company.com" or tool = "Veeam").

• Scenario: System-Wide Email Alerts from Monitoring Tools
  Description: Internal monitoring tools like Splunk, Datadog, or Prometheus send alert emails to administrators or security teams.
  Filter/Exclusion: Exclude emails sent by monitoring tools (e.g., sender = "splunk@company.com" or subject LIKE '%Alert%').

• Scenario: Automated User Onboarding Email Workflow
  Description: An automated onboarding process (e.g., using Okta, Azure AD, or LDAP) sends welcome or confirmation emails to new users.
  Filter/Exclusion: Exclude emails from onboarding systems (e.g., sender = "onboarding@company.com" or subject LIKE '%Welcome%').

• Scenario: Internal Help Desk Ticketing System Notifications
  Description: Emails sent by an internal ticketing system (e.g., Zendesk, ServiceNow, or Jira) to notify users of ticket updates.
  Filter/Exclusion: Exclude emails from help desk systems (e.g., sender = "helpdesk@company.com" or subject LIKE '%Ticket%').

• Scenario: Daily System Health Reports Sent by Admins
  Description: System administrators send daily health reports or summaries to internal teams using tools like PowerShell, Python, or Bash scripts.
  Filter/Exclusion: Exclude emails sent