User Email Submissions (FP) - Top Intra-Org P2 Senders

Hunt Hypothesis

This hypothesis targets potential phishing campaigns where attackers successfully mimic internal communication patterns, causing users to submit legitimate-looking intra-organizational emails as false positives. Proactively hunting for these submissions allows the SOC to identify compromised internal accounts or sophisticated spoofing attempts that evade standard external threat filters.

KQL Query

let Submissions = CloudAppEvents
    | where Timestamp > ago(30d)
    | where ActionType == "UserSubmission"
    | extend RawData = parse_json(RawEventData)
    | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
    | distinct NetworkMessageId, RecipientObjectId;
EmailEvents
| where Timestamp > ago(30d)
| join kind=inner Submissions on NetworkMessageId, RecipientObjectId
// De-duplicate to the latest EmailEvents record per message and recipient before counting
| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
| where EmailDirection == "Intra-org"
| summarize count() by SenderMailFromAddress
| top 10 by count_
| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_

Analytic Rule Definition

id: 2e5e39ae-99f9-4ba0-b5c4-9e76919a0f53
name: User Email Submissions (FP) - Top Intra-Org P2 Senders
description: |
  This query visualises the top 10 intra-org senders of emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 intra-org senders of emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Submissions = CloudAppEvents
      | where Timestamp > ago(30d)
      | where ActionType == "UserSubmission"
      | extend RawData = parse_json(RawEventData)
      | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
      | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
      | distinct NetworkMessageId, RecipientObjectId;
  EmailEvents
  | where Timestamp > ago(30d)
  | join kind=inner Submissions on NetworkMessageId, RecipientObjectId
  // De-duplicate to the latest EmailEvents record per message and recipient before counting
  | summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Intra-org"
  | summarize count() by SenderMailFromAddress
  | top 10 by count_
  | project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders FP.yaml)

False Positive Guidance

• Scenario: Automated ITSM or Service Desk workflows (e.g., ServiceNow, Jira Service Management) where a bot or integration account sends status updates, ticket confirmations, or SLA breach alerts to distribution lists. These emails are often flagged by users as “spam” or “unwanted” because they are high-volume and transactional, leading to frequent FP submissions.
  • Filter/Exclusion: Exclude senders matching known ITSM bot identities (e.g., itsm-bot@domain.com, jira-service@domain.com) or accounts with the Machine or ServiceAccount attribute in the directory.
• Scenario: Scheduled reporting jobs from BI or ETL platforms (e.g., Power BI Service, Tableau, or internal Python scripts using smtplib) that send daily KPI dashboards or data quality reports to departmental mailboxes. Users frequently mark these as “False Positive” if the subject line is generic (e.g., “Daily Report”) or if the attachment type is unfamiliar (e.g., .parquet, .json).
  • Filter/Exclusion: Exclude senders associated with specific reporting service accounts (e.g., bi-reporter@domain.com, etl-service@domain.com) or filter based on consistent sending times (e.g., 02:00–04:00 AM) combined with high volume.
• Scenario: Onboarding/Offboarding automation scripts (e.g., Azure AD Connect sync notifications, HRIS integrations like Workday or SAP SuccessFactors) that send welcome packets, credential reset links, or deactivation confirmations. New hires or recently offboarded users may submit these as FPs if the email appears to come from an unfamiliar internal address or if the link is blocked by conditional access policies.
  • Filter/Exclusion: Exclude senders from known HRIS or