Detect Spoofed Email Cases
Query
EmailEvents
| join kind=inner (IdentityInfo) on $left.SenderDisplayName == $right.AccountDisplayName
// Filter by emails detected as Threat, delivered into Inbox-Folder and non-sent by owned Email Domains
| where isnotempty(ThreatTypes) and DeliveryLocation contains "Inbox" and SenderMailFromDomain !in ("domain1.com","domain2.com")
// excluding OOF mails, auto-replies or blank DisplayNames also helps to reduce false positives
| where Subject !startswith "Automatic reply" and isnotempty(SenderDisplayName)
// The following lines are used to see if the recipient contains the surname of the sender which could means that the user is forwarding emails to it personal email. If due to some DLP Policies it should not be allowed, you can remove these lines
| extend DNsplit=split(SenderDisplayName, " ")
| extend name = tostring(DNsplit[0])
| extend surname = tostring(DNsplit[1])
| extend surname = tolower(surname)
| where RecipientEmailAddress !contains surname
// if you have some internal services such as Sharepoint, you can add your internal Network to be excluded and detect spoofing cases sent by another Sharepoint services
| where SenderFromDomain !contains "sharepoint" and SenderIPv4 !startswith "20.117.7"
| project SenderDisplayName, surname,AccountDisplayName, SenderMailFromAddress, RecipientEmailAddress,SenderFromAddress, Subject, SenderIPv4About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1656 | Impersonation |
Author: Sergio Albea (04/07/2024)
Detection of spoofed Emails
It has been a long journey to create a query that shows a high percentage of true positives regarding spoofed emails, but finally, I am proud of the results achieved! Basically, I check emails received where the DisplayName matches with EntraID DisplayName Accounts, and then I apply multiple filters and conditions to obtain the most accurate true positive results.
Explanation
This query is designed to detect spoofed emails by identifying instances where the sender's display name in an email matches a known account display name in the organization's directory (EntraID). Here's a simplified breakdown of what the query does:
-
Data Sources: It uses two data sources:
EmailEventsandIdentityInfo. The query joins these on the condition that the sender's display name in the email matches the account display name in the directory. -
Filtering Criteria:
- It looks for emails marked as threats that were delivered to the inbox.
- It excludes emails sent from specific owned domains (e.g., "domain1.com", "domain2.com").
- It filters out automatic replies and emails with empty display names to reduce false positives.
-
Recipient Check:
- It checks if the recipient's email address contains the sender's surname, which might indicate that the user is forwarding emails to a personal account. This part can be adjusted based on data loss prevention (DLP) policies.
-
Exclusions:
- It excludes emails from internal services like SharePoint or specific IP addresses to focus on potential spoofing from external sources.
-
Output:
- The query projects (displays) relevant information such as the sender's display name, surname, account display name, sender's email address, recipient's email address, sender's address, email subject, and sender's IP address.
Overall, this query aims to identify and highlight potential spoofed emails by applying a series of filters and conditions to ensure high accuracy in detecting true positive cases.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques