Sergio Albea
@Sergio_AlbeaTrusted contributorCompletionist
15 followers230 downloads2,155 copies99 likes17,300 views
73 detections
Filters
Last updated
All Time
Detection languages
73
Categories
11
11
9
8
7
Platforms
39
18
8
8
7
Products / Services
32
18
5
4
3
MITRE Techniques
14
12
11
10
9
CVEs
1
1
1
1
Microsoft has announced new restrictions on email sending for organizations that use the default onmicrosoft domains.
A throttling system will be enforced, limiting external email delivery to a maximum of 100 recipients per organization every 24 hours. To summarize:
1. Microsoft limits onmicrosoft.com domains to 100 external emails daily.
2. Targets cybercriminals exploiting new tenants, protecting shared domain reputation.
3. Organizations must purchase custom domains, rollout phases through June 2026.
The following KQL Query shows the number of distinct external domains where your onmicosoft.com domain, has been sending emails during a day. Could be that you don't detect 100 domains x day but in any case, I would recommend to start to purchase / configure your own domains instead of use the mentioned one.
A throttling system will be enforced, limiting external email delivery to a maximum of 100 recipients per organization every 24 hours. To summarize:
1. Microsoft limits onmicrosoft.com domains to 100 external emails daily.
2. Targets cybercriminals exploiting new tenants, protecting shared domain reputation.
3. Organizations must purchase custom domains, rollout phases through June 2026.
The following KQL Query shows the number of distinct external domains where your onmicosoft.com domain, has been sending emails during a day. Could be that you don't detect 100 domains x day but in any case, I would recommend to start to purchase / configure your own domains instead of use the mentioned one.
KQL Query
This KQL query is designed to detect adversaries attempt to modify the boot configuration using bcdedit commands. Such changes are often used to disable recovery options or suppress error messages after encryption, helping ransomware persist stealthily across reboot.
Page 8 of 8