Top 100 senders

Hunt Hypothesis

This query helps reviewing top 100 senders in your organization in last 30 days

KQL Query

EmailEvents 
| where Timestamp > ago(30d)
| summarize mailCountBySender = count() by SenderMailFromAddress 
| top 100 by mailCountBySender

Analytic Rule Definition

id: cadf6e78-2a9a-4fb5-b788-30a592d699d3
name: Top 100 senders
description: |
  This query helps reviewing top 100 senders in your organization in last 30 days
description-detailed: |
  This query helps reviewing top 100 senders in your organization in last 30 days using Defender for Office 365 data
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d)
  | summarize mailCountBySender = count() by SenderMailFromAddress 
  | top 100 by mailCountBySender
version: 1.0.0

Required Data Sources

False Positive Guidance

• Scenario: Automated report distribution via Microsoft Exchange

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top 100 senders.yaml)