Email bombing attacks

id: 8d6ecda2-1cc1-49f8-a208-de0e5b42a61b
name: Email bombing attacks
description: |
  This query helps reviewing recipients who are potentially victim of email bombing attacks
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - Initial access
query: |
  // Find mail that is older than 4 hrs and establish if it is a reply/forward or not. Join that to recent mail where the User hadn't communicated previously. These are new first contact messages.
  let Contact_Established = EmailEvents 
  | where Timestamp <= ago(4hr)
  | where DeliveryLocation != "Quarantine"
  and EmailDirection == "Inbound"
  and OrgLevelAction != "Block"
  and UserLevelAction != "Block"
  | extend NewMsg = case(Subject startswith "RE:", false, Subject startswith "FW:", false, true )
  | where NewMsg == false
  | project Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress);
  // Find new mail in the last 4hrs.
  EmailEvents
  | where Timestamp > ago(4hr)
  and DeliveryAction == "Delivered"
  | extend Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress)
  | where Pair !in (Contact_Established)
  | summarize 5_Min_Count = dcount(NetworkMessageId) by RecipientEmailAddress, bin(Timestamp, 5m)
  | where 5_Min_Count > 5 // check if recipient has received more than 5 first contact emails in 5 mins