Message from an Accepted Domain with DMARC TempError

Description

This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result.

Query · kql

let SenderDomains = pack_array ('contoso.com','fabrikam.fr');
EmailEvents
| where EmailDirection == 'Inbound' and SenderMailFromDomain in (SenderDomains)
| extend SPF= tostring(parse_json(AuthenticationDetails).SPF)
| extend DMARC= tostring(parse_json(AuthenticationDetails).DMARC)
| where DMARC == "temperror" or SPF == "temperror"
Raw source Message from an Accepted Domain with DMARC TempError · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a256f4ea-deec-4fcd-bdf3-63987638eed9
name: Message from an Accepted Domain with DMARC TempError
description: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result.
description-detailed: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result. DMARC or SPF results can be modified to trigger on "temperror", "permerror", "softfail" or "fail" depending on requirements. Can be run in Continuous (NRT) frequency. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SenderDomains = pack_array ('contoso.com','fabrikam.fr');
  EmailEvents
  | where EmailDirection == 'Inbound' and SenderMailFromDomain in (SenderDomains)
  | extend SPF= tostring(parse_json(AuthenticationDetails).SPF)
  | extend DMARC= tostring(parse_json(AuthenticationDetails).DMARC)
  | where DMARC == "temperror" or SPF == "temperror"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.