Detect Microsoft One Time Pass Code Emails Via Internet Message Id Odspnotify Value
Query
//Sergio Albea 19-04-2026 ©️
EmailEvents
| where InternetMessageId contains "OneTimePasscode"
| where RecipientDomain !in ('trustedomain.ch','trustedomain2.ch')
| project InternetMessageId,Subject, RecipientDomain, RecipientEmailAddress, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1621 | Multi-Factor Authentication Request Generation |
Author: Sergio Albea (22/04/2026)
Detect Microsoft OneTimePassCode Emails via InternetMessageId odspnotify value
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1621 | MFA abuse |
| Author | Sergio Albea (19/04/2026) |
|---|
Description: If you are in a country where there is more than one local language, like me in Switzerland, it is challenging to create detections based on subjects because you can have them in multiple languages. Therefore, focusing on the value odspnotify inside of InternetMessageId - which does not change based on the language - helps to detect cases. This one is related to OneTimePassCode and is useful to identify if the code is sent to other domains, which could mean that a forwarding rule has been configured or some other suspicious activity.
Explanation
This query is designed to detect potentially suspicious activity related to Microsoft OneTimePassCode emails. Here's a simple breakdown of what it does:
-
Purpose: The query aims to identify instances where OneTimePassCode emails are sent to domains that are not trusted, which could indicate unauthorized forwarding or other suspicious activities.
-
Context: In multilingual countries like Switzerland, email subjects can vary in language, making it difficult to create reliable detections based on subject lines. Instead, this query focuses on a specific value, "odspnotify," within the InternetMessageId, which remains consistent across languages.
-
Query Explanation:
- The query searches through email events to find emails where the InternetMessageId contains "OneTimePasscode."
- It filters out emails sent to trusted domains (e.g., 'trustedomain.ch', 'trustedomain2.ch').
- It then projects (or selects) specific fields for further analysis: InternetMessageId, Subject, RecipientDomain, RecipientEmailAddress, and ReportId.
-
Outcome: By identifying OneTimePassCode emails sent to untrusted domains, the query helps detect potential misuse of multi-factor authentication (MFA), such as unauthorized forwarding rules or other suspicious activities.
