Top Domains Outbound with Emails with Threats Inbound (Partner BEC)

Hunt Hypothesis

This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)

KQL Query

EmailEvents
| where EmailDirection == "Outbound"
| project RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
| summarize count() by RecipientDomain
| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain
| join (EmailEvents | where EmailDirection == "Inbound" and isempty(ThreatTypes)==false) on SenderFromDomain
| summarize max(OutboundCount),count() by SenderFromDomain
| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_
| sort by OutboundEmails

Analytic Rule Definition

id: 195d52f8-7669-444a-9021-f30c140cb9ac
name: Top Domains Outbound with Emails with Threats Inbound (Partner BEC)
description: |
  This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
description-detailed: |
  This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where EmailDirection == "Outbound"
  | project RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
  | summarize count() by RecipientDomain
  | project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain
  | join (EmailEvents | where EmailDirection == "Inbound" and isempty(ThreatTypes)==false) on SenderFromDomain
  | summarize max(OutboundCount),count() by SenderFromDomain
  | project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_
  | sort by OutboundEmails
version: 1.0.0

Required Data Sources

False Positive Guidance

• Scenario: Internal Service Communication with Partner Domains
  Description:

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Top Domains with BEC Threats inbound.yaml)