Bulk outbound mail to novel recipients correlated with risky sign-in reuse
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
Microsoft Sentinel (KQL)
