Automated email notifications and suspicious sign-in activity

id: a7acfaf4-e03e-409d-a16e-dcde33f7dba3
name: Automated email notifications and suspicious sign-in activity
description: |
  This query helps hunting for Automated email notifications and suspicious sign-in activity
description-detailed: |
  This query helps hunting for Automated email notifications and suspicious sign-in activity. 
  By correlating the email from the Microsoft notification service or Dropbox automated notification service with a suspicious sign-in activity, we can identify compromises, especially from securely shared SharePoint or Dropbox files.
  Shared by Microsoft Threat Intelligence: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EntraIdSignInEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
 let usersWithSuspiciousEmails = EmailEvents
 | where SenderFromAddress in ("no-reply@notify.microsoft.com", "no-reply@dropbox.com") or InternetMessageId startswith "<OneTimePasscode"
 | where isnotempty(RecipientObjectId)
 | distinct RecipientObjectId;
 EntraIdSignInEvents
 | where AccountObjectId in (usersWithSuspiciousEmails)
 | where RiskLevelDuringSignIn == 100
version: 1.0.0