Email bombing attacks

Hunt Hypothesis

Email bombing attacks involve adversaries sending a large volume of emails to a single recipient to overwhelm their inbox and potentially disrupt their ability to receive legitimate communications. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential disruptions to user productivity and security posture.

KQL Query

// Find mail that is older than 4 hrs and establish if it is a reply/forward or not. Join that to recent mail where the User hadn't communicated previously. These are new first contact messages.
let Contact_Established = EmailEvents 
| where Timestamp <= ago(4hr)
| where DeliveryLocation != "Quarantine"
and EmailDirection == "Inbound"
and OrgLevelAction != "Block"
and UserLevelAction != "Block"
| extend NewMsg = case(Subject startswith "RE:", false, Subject startswith "FW:", false, true )
| where NewMsg == false
| project Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress);
// Find new mail in the last 4hrs.
EmailEvents
| where Timestamp > ago(4hr)
and DeliveryAction == "Delivered"
| extend Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress)
| where Pair !in (Contact_Established)
| summarize 5_Min_Count = dcount(NetworkMessageId) by RecipientEmailAddress, bin(Timestamp, 5m)
| where 5_Min_Count > 5 // check if recipient has received more than 5 first contact emails in 5 mins

Analytic Rule Definition

id: 8d6ecda2-1cc1-49f8-a208-de0e5b42a61b
name: Email bombing attacks
description: |
  This query helps reviewing recipients who are potentially victim of email bombing attacks
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - Initial access
query: |
  // Find mail that is older than 4 hrs and establish if it is a reply/forward or not. Join that to recent mail where the User hadn't communicated previously. These are new first contact messages.
  let Contact_Established = EmailEvents 
  | where Timestamp <= ago(4hr)
  | where DeliveryLocation != "Quarantine"
  and EmailDirection == "Inbound"
  and OrgLevelAction != "Block"
  and UserLevelAction != "Block"
  | extend NewMsg = case(Subject startswith "RE:", false, Subject startswith "FW:", false, true )
  | where NewMsg == false
  | project Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress);
  // Find new mail in the last 4hrs.
  EmailEvents
  | where Timestamp > ago(4hr)
  and DeliveryAction == "Delivered"
  | extend Pair = strcat(SenderMailFromAddress,"|",RecipientEmailAddress)
  | where Pair !in (Contact_Established)
  | summarize 5_Min_Count = dcount(NetworkMessageId) by RecipientEmailAddress, bin(Timestamp, 5m)
  | where 5_Min_Count > 5 // check if recipient has received more than 5 first contact emails in 5 mins

Required Data Sources

MITRE ATT&CK Context

• Tactic: Initial access

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Hunting/Email bombing.yaml)

False Positive Guidance

• Scenario: Scheduled Email Backup Job
  Description: A legitimate scheduled job runs nightly to back up email data, sending a large volume of emails to a backup server.
  Filter/Exclusion: Exclude traffic originating from the backup job’s scheduled task (e.g., taskname = "EmailBackupJob" or process_name = "backup_service.exe").

• Scenario: Automated Email Reporting Tool
  Description: A reporting tool sends daily summaries to multiple stakeholders, resulting in a high volume of emails to various recipients.
  Filter/Exclusion: Exclude emails sent by the reporting tool (e.g., sender = "[email protected]" or process_name = "reporting_tool.exe").

• Scenario: User-Initiated Email Forwarding
  Description: A user forwards a large number of emails to a distribution list for team collaboration, which may trigger the rule.
  Filter/Exclusion: Exclude emails where the sender is a known user forwarding to a distribution list (e.g., sender = "[email protected]" and to = "[email protected]").

• Scenario: Email Archiving System
  Description: An email archiving system processes and sends archived emails to a third-party service, generating a high volume of email traffic.
  Filter/Exclusion: Exclude emails from the archiving system (e.g., process_name = "archive_service.exe" or sender = "[email protected]").

• Scenario: System-Wide Email Notification
  Description: A system-wide notification tool sends emails to multiple users about system updates or maintenance, which may be flagged as email bombing.
  Filter/Exclusion: Exclude emails sent by the notification service (e.g., sender = "[email protected]" or process_name = "notification_service.exe").