[IA] - Detect Potential Malicious Emails Based on InternetMessageId Dates
The are some cases where InternetMessageIds contain a date integrated, sometimes encoded, sometimes not. Therefore, we have two timestamps to compare: - InternetMessageId date → usually when the sending system generated the message. - Timestamp (EmailEvents) → when Microsoft received/processed the email. So if we compare “when it was created” vs “when it arrived”, we can detect cases such as emails created by the system but, due to local configuration, email campaigns that deliver slowly, or messages that were postponed compared to when they were received by Microsoft. The ratio of true positive was really high and multiple emails were not detected as a Threat so good case to add as a detection.
Microsoft Sentinel (KQL)
