User not covered under display name impersonation

Description

This query helps to find threats using display name impersonation for users not already protected with User Impersonation

Query · kql

let display_names = 
IdentityInfo 
  | summarize by AccountDisplayName 
  | project-rename  SenderDisplayName = AccountDisplayName; 
EmailEvents 
  | where EmailDirection == "Inbound" 
  | where ThreatNames != "" 
  | where ThreatNames !contains "Impersonation User" 
  | lookup kind=inner (display_names) on SenderDisplayName, $left.SenderDisplayName == $right.SenderDisplayName 
  | where SenderDisplayName != "" 
  | summarize by SenderDisplayName
Raw source User not covered under display name impersonation · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: e90345b3-439c-44e1-a85d-8ae84ad9c65b
name: User not covered under display name impersonation
description: |
  This query helps to find threats using display name impersonation for users not already protected with User Impersonation
description-detailed: |
  This query helps to find threats using display name impersonation for users not already protected with User Impersonation
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - IdentityInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let display_names = 
  IdentityInfo 
    | summarize by AccountDisplayName 
    | project-rename  SenderDisplayName = AccountDisplayName; 
  EmailEvents 
    | where EmailDirection == "Inbound" 
    | where ThreatNames != "" 
    | where ThreatNames !contains "Impersonation User" 
    | lookup kind=inner (display_names) on SenderDisplayName, $left.SenderDisplayName == $right.SenderDisplayName 
    | where SenderDisplayName != "" 
    | summarize by SenderDisplayName
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.