User Email Submissions (FP) - Top Inbound Subjects

Hunt Hypothesis

This hypothesis targets potential phishing campaigns or social engineering attacks (T1566) where adversaries craft specific email subjects to bypass user suspicion or trigger automated rules, leading to a high volume of false positive submissions that may mask malicious traffic. Proactively hunting for recurring subject lines in user-reported false positives allows the SOC to identify emerging phishing trends or targeted spear-phishing attempts that are being consistently dismissed by users, enabling early detection of sophisticated email-based intrusions within the Azure Sentinel environment.

KQL Query

let Submissions = CloudAppEvents
    | where Timestamp > ago(30d)
    | where ActionType == "UserSubmission"
    | extend RawData = parse_json(RawEventData)
    | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
    | distinct NetworkMessageId, RecipientObjectId;
EmailEvents
| where Timestamp > ago(30d)
| join kind=inner Submissions on NetworkMessageId, RecipientObjectId
// De-duplicate to the latest EmailEvents record per message and recipient before counting
| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
| where EmailDirection == "Inbound"
| summarize count() by Subject
| top 10 by count_
| project ['Subject'] = Subject, ['Emails'] = count_

Analytic Rule Definition

id: b2c772f0-f6b2-406f-9a80-756b596f0b57
name: User Email Submissions (FP) - Top Inbound Subjects
description: |
  This query visualises the top 10 subjects of inbound emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 subjects of inbound emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Submissions = CloudAppEvents
      | where Timestamp > ago(30d)
      | where ActionType == "UserSubmission"
      | extend RawData = parse_json(RawEventData)
      | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
      | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
      | distinct NetworkMessageId, RecipientObjectId;
  EmailEvents
  | where Timestamp > ago(30d)
  | join kind=inner Submissions on NetworkMessageId, RecipientObjectId
  // De-duplicate to the latest EmailEvents record per message and recipient before counting
  | summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Inbound"
  | summarize count() by Subject
  | top 10 by count_
  | project ['Subject'] = Subject, ['Emails'] = count_
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions - Top Inbound Subjects FP.yaml)

False Positive Guidance

• Scenario: Automated ITSM or Ticketing System Notifications.

  • Description: Enterprise ITSM platforms like ServiceNow, Jira Service Management, or Freshdesk often send high-volume automated emails (e.g., “Ticket #12345 Updated,” “SLA Breach Alert”) to distribution lists or individual users. If these are routed through a mail gateway or client that allows user submission of false positives (e.g., via a “Mark as FP” button in Outlook or a web portal), these consistent, high-frequency subjects will dominate the top 10 list.
  • Filter/Exclusion: Exclude subjects containing keywords such as “Ticket,” “SLA,” “JIRA-,” “ServiceNow,” or “Freshdesk.” Alternatively, filter by sender domain (e.g., @it.svc.local or @jira.company.com) if the submission mechanism captures sender metadata.

• Scenario: Scheduled Backup or Monitoring Tool Alerts.

  • Description: Monitoring and backup solutions like Veeam, Commvault, or Datadog send scheduled status reports (e.g., “Daily Backup Success Report,” “Datadog Watchdog Alert”) to operations teams. These emails have highly predictable subject lines that recur daily or weekly. If users in the Ops team frequently mark these as false positives (perhaps because they are expected noise), these subjects will appear at the top of the visualization.
  • Filter/Exclusion: Exclude subjects containing “Backup,” “Commvault,” “Veeam,” “Datadog,” or “Watchdog.” Consider excluding senders from known monitoring infrastructure IPs or service accounts (e.g., backup-service@company.com).

• Scenario: HR or Payroll System Communications.

  • Description: HR systems like Workday, BambooHR, or ADP generate routine communications such as “Payroll Processing Complete,” ”