Top Spoof intra-org detections by Sender domain (P1/P2)

id: 11c4556a-0d77-47ba-9564-0818065c270d
name: Top Spoof intra-org detections by Sender domain (P1/P2)
description: |
  This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
description-detailed: |
  This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where EmailDirection == "Inbound"
  | summarize TotalEmailCount = count(),
  SpoofInternalCount = countif(DetectionMethods has_any ('Phish":["Spoof intra-org"]')) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain
  | extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))
  | where SpoofInternalCount !=0
  | sort by SpoofInternalCount desc 
  | project P1Sender,P2Sender,SpoofInternalCount,TotalEmailCount,SpoofInternal_Traffic_Percentage
  | top 10 by SpoofInternalCount
version: 1.0.0