Detection Of OOF Message Delivered Externally
Query
EmailEvents
// add your automatic replies cases in your languages
| where Subject startswith "Automatic reply:"
| where DeliveryAction has "Delivered" and EmailDirection has "Outbound"
| extend Username = split(RecipientEmailAddress, "@")[0], Domain = tostring(split(RecipientEmailAddress, "@")[1])
| extend DomainParts = split(RecipientEmailAddress, ".")
| extend DomainExtensions = tostring(DomainParts[-1])
| summarize count() by DomainExtensions ,EmailDirection, DeliveryAction,DeliveryLocation, ThreatTypes
// if you want to have deeper information instead of a general view, you can use the next line and remove/comment the previous one
//| distinct SenderDisplayName, SenderMailFromDomain, SenderIPv4, RecipientEmailAddress,DomainExtensions,Domain,Subject, EmailDirection, DeliveryAction, DeliveryLocation, ThreatTypesAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1589 | Gather Victim Identity Information |
Author: Sergio Albea (29/09/2024)
Detection of OOF message delivered externally
The following query is oriented to increase awareness about the content of OOF auto-reply messages, which often contain sensitive information such as:
- The period during a user is out (a prime time to target their account)
- Secondary email addresses to contact during it absence
- Phone numbers
The query summarize OOF messages delivered externally and classified by type of extension domain which could helps to identify where the mentioned information is being shared:
Explanation
This query is designed to monitor and analyze Out of Office (OOF) automatic reply emails that are sent externally from an organization. The goal is to identify and summarize these messages, as they may contain sensitive information that could be exploited by attackers. Here's a breakdown of what the query does:
-
Filter Emails: It looks for emails with the subject line starting with "Automatic reply:" to identify OOF messages.
-
Check Delivery Details: It ensures that these emails have been delivered and are outbound, meaning they are sent outside the organization.
-
Extract Information: The query extracts the username and domain from the recipient's email address. It also identifies the domain extension (like .com, .org, etc.) to understand where these emails are being sent.
-
Summarize Data: It summarizes the count of these emails based on the domain extension, email direction, delivery action, delivery location, and any associated threat types. This helps in identifying patterns or potential risks associated with the sharing of sensitive information in OOF messages.
-
Detailed View Option: There is an option to get a more detailed view by using a different line of code (commented out in the query), which provides specific details like sender's display name, sender's domain, sender's IP address, recipient's email address, and more.
Overall, this query helps organizations keep track of potentially sensitive information being shared in automatic replies sent externally, which could be useful for security monitoring and risk assessment.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques