huntrule

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.

FreeReviewedSigma · Medium · v4
Product
m365
Service
audit
Author
Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
Published
2026-01-27
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Microsoft 365 mailbox audit events where the Threat Intelligence engine flags an inbound email as malicious or suspicious and it is delivered to a user’s Inbox or Junk. Delivery to an end-user can indicate that the message bypassed initial blocking and warrants follow-up to assess potential spearphishing or malicious content. The detection relies on audit telemetry that includes workload, operation, directionality, and the delivery action outcome.

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange
Suspicious Microsoft Entra Device Code Authentication Flow
Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)
Suspicious OAuth Application Consent Grant via Azure Audit Logs
Suspicious OWA Proxy User-Agent Indicating Mailbox Access
Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation
Suspicious Code of Conduct Phishing Email From cocinternal.com Sender (via m365)
Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit
Suspicious Office Application Spawning Script Interpreter
Suspicious Screensaver File Executed as Installer via process_creation
Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Pivot detection · T1566.002 · 9 related

Changelog

v4
  1. v4
    Candidate ingested via manual entry.2026-07-31
  2. v3
    Candidate ingested via manual entry.2026-07-31
  3. v2
    Candidate ingested via manual entry.2026-07-31
  4. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.