User Email Submissions (FP) - Top Inbound P2 Senders

Hunt Hypothesis

This hypothesis targets adversaries leveraging the T1566 Phishing technique to establish a trusted sender reputation by repeatedly sending emails that users consistently mark as false positives, thereby bypassing automated filtering. Proactively hunting for this pattern in Azure Sentinel allows the SOC to identify compromised or spoofed external senders that have successfully conditioned user behavior, reducing the likelihood of successful spear-phishing attacks against high-value targets.

KQL Query

let Submissions = CloudAppEvents
    | where Timestamp > ago(30d)
    | where ActionType == "UserSubmission"
    | extend RawData = parse_json(RawEventData)
    | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
    | distinct NetworkMessageId, RecipientObjectId;
EmailEvents
| where Timestamp > ago(30d)
| join kind=inner Submissions on NetworkMessageId, RecipientObjectId
// De-duplicate to the latest EmailEvents record per message and recipient before counting
| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
| where EmailDirection == "Inbound"
| summarize count() by SenderMailFromAddress
| top 10 by count_
| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_

Analytic Rule Definition

id: e1973a95-fd22-4669-8758-dba8f9828c8f
name: User Email Submissions (FP) - Top Inbound P2 Senders
description: |
  This query visualises the top 10 inbound senders of emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 inbound senders of emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Submissions = CloudAppEvents
      | where Timestamp > ago(30d)
      | where ActionType == "UserSubmission"
      | extend RawData = parse_json(RawEventData)
      | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
      | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
      | distinct NetworkMessageId, RecipientObjectId;
  EmailEvents
  | where Timestamp > ago(30d)
  | join kind=inner Submissions on NetworkMessageId, RecipientObjectId
  // De-duplicate to the latest EmailEvents record per message and recipient before counting
  | summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Inbound"
  | summarize count() by SenderMailFromAddress
  | top 10 by count_
  | project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders FP.yaml)

False Positive Guidance

• Automated Ticketing System Notifications: Users frequently mark emails from ITSM platforms like ServiceNow, Jira Service Management, or Freshdesk as “False Positive” because these are expected, high-volume system notifications rather than malicious phishing attempts.

  • Filter/Exclusion: Exclude senders matching known ITSM domains (e.g., @service-now.com, @jira.com, @freshdesk.com) or specific sender names like no-reply@ticketing-system.com.

• CI/CD Pipeline Alerting: Developers and DevOps engineers often receive automated alerts from GitHub Actions, GitLab CI, or Azure DevOps regarding build failures or deployment statuses. These are legitimate, high-frequency emails that users may habitually mark as false positives to clear their inbox.

  • Filter/Exclusion: Exclude senders from CI/CD platforms such as notifications@github.com, ci@gitlab.com, or azuredevops@services.visualstudio.com.

• Scheduled Report Distributions: Business intelligence tools like Power BI, Tableau, or QlikView often send scheduled daily or weekly report digests to stakeholders. Users may mark these as false positives if they are not expecting the report or if the subject line is generic.

  • Filter/Exclusion: Exclude senders associated with BI tools (e.g., powerbi@reporting.microsoft.com, tableau@tableausoftware.com) or specific internal distribution lists used for automated reporting (e.g., reports@company.com).

• HR and Payroll System Communications: Emails from HRIS platforms like Workday, BambooHR, or ADP regarding payroll statements, benefits enrollment, or policy updates are legitimate but may be marked as false positives by users who are not actively engaged with HR tasks.

  • Filter/Exclusion: Exclude senders from HRIS providers (e.g., `