Microsoft 365 Mail Delivery of Suspicious Inbound Emails to Inbox or Junk

Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.

FreeUnreviewedSigmamediumv1

microsoft-365-mail-delivery-of-suspicious-inbound-emails-to-inbox-or-junk-3569aefd

title: Microsoft 365 Mail Delivery of Suspicious Inbound Emails to Inbox or Junk
id: b28de01c-248d-4a83-a249-0e95ea69a2f8
status: experimental
description: This rule flags inbound email delivery events where Microsoft Defender for Office 365 labels the message as suspicious or malicious and it reaches a user mailbox (Inbox or Junk). Attackers rely on partial delivery to get phishing content or malicious attachments past initial protections and into the user’s view. Telemetry comes from Microsoft 365 audit data capturing the workload, operation, delivery direction, and whether the message was delivered rather than blocked.
references:
  - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
  - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
  - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_suspicious_email_delivered.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-27
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.t1566.002
logsource:
  service: audit
  product: m365
detection:
  selection:
    Workload: ThreatIntelligence
    Operation: TIMailData
    Directionality: Inbound
  filter_main_blocked:
    DeliveryAction: Blocked
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 3569aefd-e535-4391-8c18-24bd01a21eaf
    type: derived

What it detects

This rule flags inbound email delivery events where Microsoft Defender for Office 365 labels the message as suspicious or malicious and it reaches a user mailbox (Inbox or Junk). Attackers rely on partial delivery to get phishing content or malicious attachments past initial protections and into the user’s view. Telemetry comes from Microsoft 365 audit data capturing the workload, operation, delivery direction, and whether the message was delivered rather than blocked.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.