[IC] - Detecting emails sent by countries using non-oficial languages
During my vacation, I've been enjoying conversations with people from different countries about their national teams and the World Cup. What I don't expect (although it certainly can happen) is a Mexican speaking Japanese, a Spaniard speaking Russian, or an Egyptian speaking Spanish. Yet, this is becoming more and more common, and I love it. Our world is becoming increasingly connected and multicultural. However, the same logic doesn't always apply to emails. That thought inspired me to build a KQL query that I'll explore further after my break, but I wanted to share it now. The idea is detect emails where the language doesn't match the expected language(s) of the sender's country. While this isn't a detection by itself, it can be a valuable hunting signal when combined with other indicators. KQL Query Filter options: EmailCount < X → Filter based on the number of emails observed. Country !in ("Spain") → Exclude countries with a higher false-positive ratio. SenderDomains !in ("Domain1","Domain2") → Exclude trusted sender domains.
Microsoft Sentinel (KQL)
