← Back to SOC feed Coverage →

Spam and Phish allowed to inbox by Admin Overrides

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-12T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may bypass email filtering by exploiting admin overrides to deliver phishing or spam emails to user inboxes. SOC teams should proactively hunt for this behavior to identify and mitigate potential credential theft or malware delivery vectors in their Azure Sentinel environment.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery = EmailEvents
| where Timestamp >= TimeStart
| where ConfidenceLevel != "" and OrgLevelPolicy!="" and OrgLevelAction == "Allow" and DeliveryAction == "Delivered";
let spam=baseQuery
| where ThreatTypes has 'Spam'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Allowed Spam";
let phish=baseQuery
| where ThreatTypes has 'Phish'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Allowed Phish";
union spam,phish
| project Count, Details, Timestamp
| render timechart

Analytic Rule Definition

id: 0e37c1a4-86cd-4641-a514-28a431824369
name: Spam and Phish allowed to inbox by Admin Overrides
description: |
  This query helps in reviewing malicious emails allowed due to admin overrides
description-detailed: |
  This query helps in reviewing malicious emails allowed due to admin defined detection overrides in Defender for Office 365
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery = EmailEvents
  | where Timestamp >= TimeStart
  | where ConfidenceLevel != "" and OrgLevelPolicy!="" and OrgLevelAction == "Allow" and DeliveryAction == "Delivered";
  let spam=baseQuery
  | where ThreatTypes has 'Spam'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Allowed Spam";
  let phish=baseQuery
  | where ThreatTypes has 'Phish'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Allowed Phish";
  union spam,phish
  | project Count, Details, Timestamp
  | render timechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to Admin Overrides.yaml