Top outbound recipient domains sending inbound emails with threats

id: 61bd29e8-fcfa-4f10-bc8f-b3a64e9493f7
name: Top outbound recipient domains sending inbound emails with threats
description: |
  This query helps hunting for top outbound recipient domains which are sending inbound emails with threats
description-detailed: |
  This query helps hunting for top outbound recipient domains which are sending inbound emails with threats. 
  Top outbound recipient domains by volume and number of inbound emails from the same domains as senders with threats.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where EmailDirection == "Outbound"
  | project RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
  | summarize count() by RecipientDomain
  | project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain
  | join (EmailEvents | where EmailDirection == "Inbound" and isempty(ThreatTypes)==false) on SenderFromDomain
  | summarize max(OutboundCount),count() by SenderFromDomain
  | project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_
  | sort by OutboundEmails
version: 1.0.0