User Email Submissions (FP) - Top P2 Sender Domains

Hunt Hypothesis

This hypothesis targets potential phishing campaigns where attackers exploit trusted, high-volume sender domains to bypass user scrutiny, as evidenced by a high frequency of false positive submissions from these specific P2 domains. Proactively hunting for this pattern in Azure Sentinel allows the SOC to identify compromised or spoofed legitimate domains that adversaries leverage to deliver malicious payloads while maintaining a low profile against standard detection thresholds.

KQL Query

CloudAppEvents
| where ActionType == "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)
| where SubmissionContentType == "Mail" and SubmissionType == "3"
| summarize count() by P2SenderDomain
| top 10 by count_
| project ['Sender Domain'] = P2SenderDomain, ['Emails'] = count_

Analytic Rule Definition

id: d090ed89-3c2b-4bd7-9b87-d8a5f552e174
name: User Email Submissions (FP) - Top P2 Sender Domains
description: |
  This query visualises the top 10 sender domains of emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 sender domains of emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "Mail" and SubmissionType == "3"
  | summarize count() by P2SenderDomain
  | top 10 by count_
  | project ['Sender Domain'] = P2SenderDomain, ['Emails'] = count_
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) sender domains FP.yaml)

False Positive Guidance

• Automated Reporting Tools: Scheduled jobs from BI platforms like Power BI or Tableau often send daily/weekly digest emails to distribution lists. If a user marks one of these as a false positive (e.g., to clean up their inbox or because the content was expected), the domain (e.g., powerbi.com or tableau.com) will appear in the top senders.
  • Filter/Exclusion: Exclude known SaaS reporting domains such as *.powerbi.com, *.tableau.com, *.looker.com, or *.qlik.com from the “Top P2 Sender Domains” visualization if they are consistently marked as FP by users.
• IT Service Management (ITSM) Notifications: Ticketing systems like Jira Service Management, ServiceNow, or BMC Helix send automated status updates, assignment notifications, or resolution confirmations. Users frequently mark these as false positives if they are not actionable alerts or if the user is not the primary assignee.
  • Filter/Exclusion: Exclude ITSM notification domains such as *.atlassian.net, *.service-now.com, or *.bmc.com when analyzing user-submitted false positives, as these are typically system-generated rather than human-authored.
• CI/CD and DevOps Pipeline Alerts: Continuous Integration/Deployment tools like GitHub Actions, Jenkins, or Azure DevOps send build success/failure notifications or deployment summaries. Developers or DevOps engineers may mark these as false positives if the build was expected or if the alert is informational rather than an incident.
  • Filter/Exclusion: Exclude CI/CD notification domains such as *.github.com, *.jenkins.io, or *.dev.azure.com from the top sender list to prevent infrastructure noise from skewing the analysis of user behavior.