Suspicious Email Delivered In Microsoft 365

Title: Suspicious Email Delivered In Microsoft 365
Status: experimental
Description:Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
References:
  -https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
  -https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
  -https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-01-27
modified:None
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'
• -'attack.t1566.002'

Logsource:

• service: audit
• product: m365

Detection:
  selection:
    Workload: 'ThreatIntelligence'
    Operation: 'TIMailData'
    Directionality: 'Inbound'
  filter_main_blocked:
    DeliveryAction: 'Blocked'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: medium