Suspicious Email Interaction with Downstream Execution IOC
This rule detects inbound emails that have failed SPF and/or DKIM authentication checks and presents evidence of post-delivery user interaction. Authentication failures on inbound email are a strong indicator of email spoofing or unauthorized sending infrastructure, commonly associated with phishing campaigns targeting organizational users. Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email: URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Microsoft Sentinel (KQL)
