Spoof attempts with auth failure

Description

This query helps in checking for spoofing attempts on the domain with Authentication failures

Query · kql

EmailEvents 
| where Timestamp > ago (1d) and DetectionMethods contains "spoof"  
| project Timestamp, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4,ThreatTypes, DetectionMethods, ThreatNames  
| evaluate bag_unpack(AR)  
| where SPF == "fail" or DMARC == "fail" or DKIM == "fail" or CompAuth == "fail"
Raw source Spoof attempts with auth failure · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5971f2e7-1bb2-4170-aa7a-577ed8a45c72
name: Spoof attempts with auth failure
description: |
  This query helps in checking for spoofing attempts on the domain with Authentication failures
description-detailed: |
  This query helps in checking for spoofing attempts on the domain with Authentication failures.
  Reference - https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-spoofing-about
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago (1d) and DetectionMethods contains "spoof"  
  | project Timestamp, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4,ThreatTypes, DetectionMethods, ThreatNames  
  | evaluate bag_unpack(AR)  
  | where SPF == "fail" or DMARC == "fail" or DKIM == "fail" or CompAuth == "fail"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.