sublimemediumRule

Sharepoint online with external recipients and external display name

An email from Sharepoint Online that was sent to multiple recipients that did not originate from a sender, by display name, in your organization.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and sender.email.email == "no-reply@sharepointonline.com"
and length(recipients.to) > 40 // You may want to adjust this threshold if 40 is too aggressive
and any(recipients.to, .email.domain.domain in $free_email_providers)
and sender.display_name not in $org_display_names

Author

vector_sec

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Sharepoint online with external recipients and external display name"
description: |
  An email from Sharepoint Online that was sent to multiple recipients that did not originate from a sender, by display name, in your organization.
type: "rule"
authors:
  - twitter: "vector_sec"
severity: "medium"
source: |
  type.inbound
  and sender.email.email == "no-reply@sharepointonline.com"
  and length(recipients.to) > 40 // You may want to adjust this threshold if 40 is too aggressive
  and any(recipients.to, .email.domain.domain in $free_email_providers)
  and sender.display_name not in $org_display_names
attack_types:
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "5579bb4b-a225-57c1-99e1-65c704bad6ad"