Hunt for email conversation take over attempts

Description

This query helps hunting for email conversation take over attempts

Query · kql

let emailDelivered = EmailEvents
| where Timestamp < ago(4hrs)
and DeliveryAction == "Delivered"
| extend Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress)
| distinct Pair;
let EmailDomains = EmailEvents
| where Timestamp < ago(4hrs)
and DeliveryAction == "Delivered"
| distinct SenderFromDomain;
EmailEvents
| where Timestamp >= ago(4hrs)
| where DeliveryLocation != "Quarantine"
and EmailDirection == "Inbound"
and OrgLevelAction != "Block"
and UserLevelAction != "Block"
| extend NewMsg = case(Subject contains "RE:", false, Subject contains "FW:", false, true )
| project Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject
| join kind=leftouter ( emailDelivered ) on Pair
| order by SenderMailFromAddress
| where NewMsg == false
and Pair1 == ""
| join kind=leftouter (EmailDomains) on SenderFromDomain
| where SenderFromDomain1 == ""
| distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject
Raw source Hunt for email conversation take over attempts · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fb46ca1b-0b46-4d9c-b3b3-2f8f807e9f72
name: Hunt for email conversation take over attempts
description: |
  This query helps hunting for email conversation take over attempts
description-detailed: |
  This query helps hunting for email conversation take over attempts using Defender for Office 365 data.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let emailDelivered = EmailEvents
  | where Timestamp < ago(4hrs)
  and DeliveryAction == "Delivered"
  | extend Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress)
  | distinct Pair;
  let EmailDomains = EmailEvents
  | where Timestamp < ago(4hrs)
  and DeliveryAction == "Delivered"
  | distinct SenderFromDomain;
  EmailEvents
  | where Timestamp >= ago(4hrs)
  | where DeliveryLocation != "Quarantine"
  and EmailDirection == "Inbound"
  and OrgLevelAction != "Block"
  and UserLevelAction != "Block"
  | extend NewMsg = case(Subject contains "RE:", false, Subject contains "FW:", false, true )
  | project Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject
  | join kind=leftouter ( emailDelivered ) on Pair
  | order by SenderMailFromAddress
  | where NewMsg == false
  and Pair1 == ""
  | join kind=leftouter (EmailDomains) on SenderFromDomain
  | where SenderFromDomain1 == ""
  | distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.