User Email Submissions (FN) - Top Inbound P2 Senders

Description

This query visualises top sender email addresses of inbound emails submitted as false negatives by users.

Query · kql

let TotalInboundbySender = EmailEvents
| where EmailDirection =="Inbound"
| summarize count() by SenderFromAddress;
CloudAppEvents 
| where ActionType == "UserSubmission" 
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
| where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
| join EmailEvents on NetworkMessageId, RecipientObjectId
| where EmailDirection == "Inbound"
| summarize UserSubmissions=count() by SenderFromAddress
| join TotalInboundbySender on SenderFromAddress
| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))
| project SenderFromAddress, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage
| top 10 by UserSubmissions desc
Raw source User Email Submissions (FN) - Top Inbound P2 Senders · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4e8ea1c2-723d-4f72-bac6-82c464b6731e
name: User Email Submissions (FN) - Top Inbound P2 Senders
description: |
  This query visualises top sender email addresses of inbound emails submitted as false negatives by users.
description-detailed: |
  This query visualises top sender email addresses of inbound emails submitted as false negatives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TotalInboundbySender = EmailEvents
  | where EmailDirection =="Inbound"
  | summarize count() by SenderFromAddress;
  CloudAppEvents 
  | where ActionType == "UserSubmission" 
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
  | where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
  | join EmailEvents on NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Inbound"
  | summarize UserSubmissions=count() by SenderFromAddress
  | join TotalInboundbySender on SenderFromAddress
  | extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))
  | project SenderFromAddress, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage
  | top 10 by UserSubmissions desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.