Empty Sender Phish Delivered to Inbox

Description

This query detects delivered phishing emails where the Sender is empty based on recently observed campaigns.

Query · kql

EmailEvents
| where EmailDirection == "Inbound"
| where SenderIPv4 startswith "27.121.5." //IP range in Japan observed in this phishing campaign
| where isempty(SenderFromAddress) and isempty(SenderDisplayName) and SenderMailFromAddress == "<>"
| where DeliveryAction != "Blocked"
Raw source Empty Sender Phish Delivered to Inbox · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c853b6d9-b33b-4172-8b18-e95e8d902e31
name: Empty Sender Phish Delivered to Inbox
description: |
  This query detects delivered phishing emails where the Sender is empty based on recently observed campaigns.
description-detailed: |
  This query detects delivered phishing emails where the Sender is empty based on recently observed campaigns. It can be used as a Continuous (NRT) Custom Detection Rule to trigger an automated action and delete the emails.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where EmailDirection == "Inbound"
  | where SenderIPv4 startswith "27.121.5." //IP range in Japan observed in this phishing campaign
  | where isempty(SenderFromAddress) and isempty(SenderDisplayName) and SenderMailFromAddress == "<>"
  | where DeliveryAction != "Blocked"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.