Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.
- Product
- m365
- Service
- audit
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-01-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Microsoft 365 mailbox audit events where the Threat Intelligence engine flags an inbound email as malicious or suspicious and it is delivered to a user’s Inbox or Junk. Delivery to an end-user can indicate that the message bypassed initial blocking and warrants follow-up to assess potential spearphishing or malicious content. The detection relies on audit telemetry that includes workload, operation, directionality, and the delivery action outcome.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
- research.splunk.comhttps://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
- github.comhttps://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_suspicious_email_delivered.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft 365 inbound suspicious email delivered to Inbox or Junk
id: b28de01c-248d-4a83-a249-0e95ea69a2f8
status: experimental
description: This rule identifies Microsoft 365 mailbox audit events where the Threat Intelligence engine flags an inbound email as malicious or suspicious and it is delivered to a user’s Inbox or Junk. Delivery to an end-user can indicate that the message bypassed initial blocking and warrants follow-up to assess potential spearphishing or malicious content. The detection relies on audit telemetry that includes workload, operation, directionality, and the delivery action outcome.
references:
- https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
- https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
- https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_suspicious_email_delivered.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-27
tags:
- attack.initial-access
- attack.t1566.001
- attack.t1566.002
logsource:
service: audit
product: m365
detection:
selection:
Workload: ThreatIntelligence
Operation: TIMailData
Directionality: Inbound
filter_main_blocked:
DeliveryAction: Blocked
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: 3569aefd-e535-4391-8c18-24bd01a21eaf
type: derived