Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.

FreeReviewedSigma · Medium · v4

Product: m365
Service: audit
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
Published: 2026-01-27
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Microsoft 365 mailbox audit events where the Threat Intelligence engine flags an inbound email as malicious or suspicious and it is delivered to a user’s Inbox or Junk. Delivery to an end-user can indicate that the message bypassed initial blocking and warrants follow-up to assess potential spearphishing or malicious content. The detection relies on audit telemetry that includes workload, operation, directionality, and the delivery action outcome.

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange

Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

Suspicious Phishing URL with Unrendered Template Placeholder (via proxy)

Suspicious Spoofed Inbound Email With Failed Authentication and Anonymous Internal Sender (via m365)

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

Possible Mamba 2FA AiTM Phishing URL Pattern

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Pivot detection · T1566.002 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-365-mail-delivery-of-suspicious-inbound-emails-to-inbox-or-junk-3569aefd

title: Microsoft 365 inbound suspicious email delivered to Inbox or Junk
id: b28de01c-248d-4a83-a249-0e95ea69a2f8
status: experimental
description: This rule identifies Microsoft 365 mailbox audit events where the Threat Intelligence engine flags an inbound email as malicious or suspicious and it is delivered to a user’s Inbox or Junk. Delivery to an end-user can indicate that the message bypassed initial blocking and warrants follow-up to assess potential spearphishing or malicious content. The detection relies on audit telemetry that includes workload, operation, directionality, and the delivery action outcome.
references:
  - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
  - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
  - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_suspicious_email_delivered.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-27
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.t1566.002
logsource:
  service: audit
  product: m365
detection:
  selection:
    Workload: ThreatIntelligence
    Operation: TIMailData
    Directionality: Inbound
  filter_main_blocked:
    DeliveryAction: Blocked
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 3569aefd-e535-4391-8c18-24bd01a21eaf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL