Exchange Single Subject Sent to Unusually High Recipient Count

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one subject line delivered to an unusually wide internal recipient set. This is the shape of internal phishing from a compromised mailbox, which is far more effective than external phishing because it arrives from a trusted colleague and passes authentication checks. Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_DELIVERED' | duration 1h | groupby subject, sender | select subject, sender, distinct_count(recipient) | having distinct_count_col1 > 25