Gmail Sender with Multiple Display Names
Email Gmail Sender With Different Display Names
Query
let Timeframe = 2h;
let suspiciousSender = EmailEvents
| where Timestamp > ago(Timeframe)
| where EmailDirection == "Inbound"
| where SenderFromAddress has "gmail.com"
| summarize
DistinctDisplayNames = dcount(SenderDisplayName),
DisplayNames = make_set(SenderDisplayName, 10) // Limitierung schützt den Speicher
by SenderFromAddress
| where DistinctDisplayNames > 1;
// Haupt-Query profitiert jetzt ebenfalls vom Zeitfilter
EmailEvents
| where Timestamp > ago(Timeframe)
| where EmailDirection == "Inbound"
| join kind=leftsemi suspiciousSender on SenderFromAddress
| order by Timestamp descAbout this query
Gmail Sender with Multiple Display Names
Query Information
MITRE ATT&CK Technique(s)
| Technique ID | Title | Link |
|---|---|---|
| T1566 | Phishing | https://attack.mitre.org/tactics/T1566/ |
| T1656 | Impersonation | https://attack.mitre.org/tactics/T1656/ |
Description
Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.
Author <Optional>
- Name: Benjamin Zulliger
- Github: https://github.com/benscha/KQLAdvancedHunting
- LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/
References
Defender XDR
Explanation
This query is designed to identify potentially suspicious behavior involving Gmail accounts. It focuses on detecting instances where a single Gmail sender address is using multiple different display names within a short period of time (specifically, within two hours). This behavior can be indicative of malicious activities such as phishing, impersonation, or spam campaigns, where an attacker might try to disguise themselves as different people or entities using the same email address.
Here's a simplified breakdown of the query:
-
Timeframe Definition: The query looks at email events from the past two hours.
-
Identify Suspicious Senders:
- It filters inbound emails from Gmail addresses.
- It counts the number of distinct display names used by each sender address.
- It collects these display names into a set for further analysis.
- It flags senders that have used more than one distinct display name.
-
Filter and Display Results:
- It then filters the email events to show only those that match the suspicious senders identified earlier.
- The results are ordered by the most recent emails first.
This query helps security analysts quickly identify and investigate potential email threats by highlighting unusual patterns in sender behavior.
