Sender recipient contact establishment

Description

This query helps in checking the sender-recipient contact establishment status

Query · kql

let emailDelivered = EmailEvents
| where Timestamp < ago(30d)
and DeliveryAction == "Delivered"
and SenderDisplayName contains "Microsoft"
| summarize count() by SenderFromAddress
| where count_ > 3 // ensuring that some level of communications has occured.
| project SenderFromAddress;
EmailEvents 
| where Timestamp > ago(24hrs)
| where DeliveryAction == "Delivered"
 and EmailDirection == "Inbound" 
 and OrgLevelAction != "Block"
 and UserLevelAction != "Block"
 and SenderDisplayName contains "Microsoft" //Change the name here
| extend NewMsg = case(Subject contains "RE:", false, Subject contains "FW:", false, true )
| project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject 
| join kind=leftanti  ( emailDelivered ) on SenderFromAddress
| order by SenderMailFromAddress
| summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject
Raw source Sender recipient contact establishment · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b2beec6a-2c1c-4319-a191-e70c2ee42857
name: Sender recipient contact establishment
description: |
  This query helps in checking the sender-recipient contact establishment status
description-detailed: |
  This query helps in checking the sender-recipient contact establishment status using Defender for Office 365 data
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let emailDelivered = EmailEvents
  | where Timestamp < ago(30d)
  and DeliveryAction == "Delivered"
  and SenderDisplayName contains "Microsoft"
  | summarize count() by SenderFromAddress
  | where count_ > 3 // ensuring that some level of communications has occured.
  | project SenderFromAddress;
  EmailEvents 
  | where Timestamp > ago(24hrs)
  | where DeliveryAction == "Delivered"
   and EmailDirection == "Inbound" 
   and OrgLevelAction != "Block"
   and UserLevelAction != "Block"
   and SenderDisplayName contains "Microsoft" //Change the name here
  | extend NewMsg = case(Subject contains "RE:", false, Subject contains "FW:", false, true )
  | project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject 
  | join kind=leftanti  ( emailDelivered ) on SenderFromAddress
  | order by SenderMailFromAddress
  | summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.