Sharepoint Email Spoofing Attempt From Unseen Organisation
Query
// Edit YOUR OrgName
let OrgName = "myORG";
let badSPSubjects = EmailEvents
| where TimeGenerated >ago(4h)
| where SenderFromAddress == "[email protected]"
| where Subject has (OrgName)
| summarize count() by Subject
// adjust this value to the size of your ORG
| where count_ > 30;
let SenderInfos = EmailEvents
| where Subject in (badSPSubjects)
| extend OrigSenderFromAddress = extract(@"<([^>]+)>", 1, tostring(Cc))
| extend OrigSenderFromDomain = tostring(split(OrigSenderFromAddress, "@")[1])
| distinct OrigSenderFromAddress, OrigSenderFromDomain, Subject;
let SenderHistory = EmailEvents
| where Timestamp > ago(30d)
| summarize HistoryCount = count() by SenderFromDomain;
let filteredDomains = SenderInfos
| join kind=leftouter SenderHistory on $left.OrigSenderFromDomain == $right.SenderFromDomain
| where isnull(HistoryCount) or HistoryCount == 0
| project OrigSenderFromDomain;
EmailEvents
| where EmailDirection == "Inbound" and DeliveryAction != "Junked"
| where Subject in (badSPSubjects)
| extend OrigSenderFromAddress = extract(@"<([^>]+)>", 1, tostring(Cc))
| extend OrigSenderFromDomain = tostring(split(OrigSenderFromAddress, "@")[1])
| where OrigSenderFromDomain in (filteredDomains)About this query
Explanation
This KQL query is designed to detect potential email spoofing attempts targeting an organization, specifically through phishing campaigns that impersonate SharePoint communications. Here's a simplified breakdown of what the query does:
-
Identify Suspicious Emails: The query looks for inbound emails sent from "[email protected]" with subjects containing the organization's name (you need to replace "myORG" with your actual organization name). It flags emails that appear to be internal communications but are actually from unknown senders.
-
High-Volume Detection: It checks for a high volume of such emails (more than 30) within the last 4 hours, indicating a potential phishing campaign.
-
Extract Sender Information: The query extracts the actual sender's email address from the Cc field and identifies the domain of these senders.
-
Check Sender History: It compares the extracted sender domains against a history of known sender domains from the past 30 days. If a domain has no history, it is flagged as suspicious.
-
Filter and Display Results: Finally, it filters the emails to show only those from domains that have not been seen in the last 30 days, indicating a potential spoofing attempt.
The second detection option follows a similar logic but focuses on identifying emails from domains not recognized as legitimate organizations based on past email traffic and known organizational domains. It also considers emails sent to the organization's domains that do not end with "onmicrosoft.com" and checks for new or unknown sender domains.
Overall, this query helps identify spear-phishing campaigns that use domain impersonation to deceive recipients into believing the emails are legitimate internal communications.