User Email Submissions (FN) - Top Inbound P2 Senders domains

Description

This query visualises top sender domains of inbound emails submitted as false negatives by users.

Query · kql

let TotalInboundbySender = EmailEvents
| where EmailDirection =="Inbound"
| summarize count() by SenderFromDomain;
CloudAppEvents 
| where ActionType == "UserSubmission" 
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
| where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
| join EmailEvents on NetworkMessageId, RecipientObjectId
| where EmailDirection == "Inbound"
| summarize UserSubmissions=count() by SenderFromDomain
| join TotalInboundbySender on SenderFromDomain
| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))
| project SenderFromDomain, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage
| top 10 by UserSubmissions desc
Raw source User Email Submissions (FN) - Top Inbound P2 Senders domains · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d7822efc-9a33-4120-8c60-661396764af1
name: User Email Submissions (FN) - Top Inbound P2 Senders domains
description: |
  This query visualises top sender domains of inbound emails submitted as false negatives by users.
description-detailed: |
  This query visualises top sender domains of inbound emails submitted as false negatives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TotalInboundbySender = EmailEvents
  | where EmailDirection =="Inbound"
  | summarize count() by SenderFromDomain;
  CloudAppEvents 
  | where ActionType == "UserSubmission" 
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
  | where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
  | join EmailEvents on NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Inbound"
  | summarize UserSubmissions=count() by SenderFromDomain
  | join TotalInboundbySender on SenderFromDomain
  | extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))
  | project SenderFromDomain, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage
  | top 10 by UserSubmissions desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.