User Submissions by Submission State (FP)

Hunt Hypothesis

This hypothesis targets potential phishing campaigns or credential harvesting attempts (T1566) where users report suspicious emails, requiring the SOC to validate whether these submissions represent genuine threats or systemic false positives that could mask real incidents. Proactively hunting for these user submissions in Azure Sentinel allows the team to correlate reported messages with threat intelligence and user behavior, ensuring that high-fidelity alerts are not dismissed due to recurring false positives while maintaining vigilance against targeted social engineering attacks.

KQL Query

CloudAppEvents
| where ActionType == "UserSubmission"
| extend RawData = parse_json(RawEventData)
| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), SubmissionState = tostring(RawData.SubmissionState)
| where RecordType == 29 and SubmissionType == "3"
| summarize count() by SubmissionState
| render piechart

Analytic Rule Definition

id: f8637343-8fbc-48de-b31a-ed4bb68b60f2
name: User Submissions by Submission State (FP)
description: |
  This query visualises user false positive submissions by submission state.
description-detailed: |
  This query visualises user false positive submissions by submission state.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend RawData = parse_json(RawEventData)
  | extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), SubmissionState = tostring(RawData.SubmissionState)
  | where RecordType == 29 and SubmissionType == "3"
  | summarize count() by SubmissionState
  | render piechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Submissions/User Submissions by Submission State - FP.yaml)

False Positive Guidance

• Scenario: A security engineer is manually testing the SIEM ingestion pipeline by generating synthetic log entries (e.g., using logstash or a custom Python script) to verify that specific fields are parsed correctly before promoting the rule to production.

  • Filter/Exclusion: Exclude submissions where the source_host matches the designated test environment IP range (e.g., 10.20.50.0/24) or where the user_agent contains the string synthetic-test.

• Scenario: An IT administrator is performing a bulk import of user accounts via a scheduled PowerShell script that writes temporary status logs to the event stream during the “Pending” or “Processing” state, which the rule misinterprets as a user action.

  • Filter/Exclusion: Exclude events where the initiated_by field is set to SYSTEM or svc-account-mgmt and the action_type is bulk_import, or filter out logs generated within the specific time window of the nightly maintenance job (e.g., 02:00-03:00 UTC).

• Scenario: A developer is using a local API client (such as Postman or a custom CLI tool) to test the state transition endpoints of the user submission service, causing rapid state changes (e.g., Draft -> Submitted -> Rejected) that trigger the “abnormal state transition” logic.

  • Filter/Exclusion: Exclude submissions where the client_ip belongs to the developer subnet (e.g., 192.168.10.0/24) and the request_id contains the prefix dev-test-, or exclude if the time_between_states is less than 500ms.

• Scenario: A CI/CD pipeline (e.g., Jenkins or