When Phishing Passes The Filters: Catching Long Sender Address Abuse

The following query represents a reference implementation used by our Detection Engineering team. Thresholds and exclusions can be tuned based on organizational risk tolerance

// --- Base email dataset (delivered only) 
let EmailBase = EmailEvents 
    | where DeliveryAction has "Delivered" 
    | where DeliveryLocation has "Inbox" 
    | extend SenderLength = strlen(SenderFromAddress) 
    | where SenderLength > 100 
    | project 
        TimeGenerated, 
        NetworkMessageId, 
        SenderFromAddress, 
        SenderLength,  
        DeliveryAction, 
        DeliveryLocation, 
        RecipientEmailAddress, 
        Subject; 

// --- Attachment summary 
let AttachmentSummary = EmailAttachmentInfo 
    | summarize  
        AttachmentCount = count(), 
        FileNames = make_list(FileName), 
        SHAs = make_list(SHA256) 
        by NetworkMessageId; 

// --- URL summary 
let UrlSummary = EmailUrlInfo 
    | summarize  
        UrlCount = count(), 
        Urls = make_list(Url) 
        by NetworkMessageId; 

// --- URL clicks 
let UrlClickedSummary = UrlClickEvents 
    | summarize  
        ClickedUrls = make_list(Url) 
        by NetworkMessageId; 

// --- Post delivery actions 
let PostDelivery = EmailPostDeliveryEvents 
    | summarize PostDeliverySummary = make_list( 
                                      pack( 
    "Action", Action, 
    "ActionResult", ActionResult, 
    "ActionTrigger", ActionTrigger, 
    "ActionType", ActionType, 
    "DeliveryLocation", DeliveryLocation, 
    "ThreatTypes", ThreatTypes 
) 
                                  ) 
        by NetworkMessageId; 

// --- Final join 
EmailBase 
| join kind=leftouter AttachmentSummary on NetworkMessageId 
| join kind=leftouter UrlSummary on NetworkMessageId 
| join kind=leftouter UrlClickedSummary on NetworkMessageId 
| join kind=leftouter PostDelivery on NetworkMessageId 
| where isempty(PostDeliverySummary) 
| where SenderFromAddress !startswith "imceaex" and SenderFromAddress !endswith "prod.outlook.com" 
| project 
    TimeGenerated, 
    Sender = SenderFromAddress, 
    SenderLength, 
    DeliveryAction, 
    DeliveryLocation, 
    Recipient = RecipientEmailAddress, 
    Subject, 
    NetworkMessageId, 
    UrlCount, 
    AttachmentCount, 
    FileNames, 
    Urls, 
    ClickedUrls, 
    PostDeliverySummary 
| order by TimeGenerated desc

This detection aligns with multiple adversary techniques focused on phishing, social engineering, and initial access:

• T1566 – Phishing
  Attackers deliver malicious messages designed to trick users into clicking links, opening attachments, or responding with sensitive information. Long sender address abuse supports phishing by masking the true sender identity and bypassing filtering logic.
• T1566.002 – Spearphishing Link
  Many emails flagged by this detection include embedded URLs intended to redirect users to credential-harvesting or malware-hosting sites. The rule enriches URL and click telemetry to support rapid validation.
• T1566.001 – Spearphishing Attachment
  Some emails may carry malicious attachments that rely on successful inbox delivery and user trust to execute. Attachment metadata is included to accelerate triage and containment.
• T1656 – Impersonation
  Excessively long sender addresses are often used to impersonate trusted services, internal systems, or known vendors, blending social engineering with technical deception.

When this detection triggers, recommended actions include:

1. Validate sender legitimacy and inspect address structure
2. Analyze URLs and attachments for malicious indicators
3. Check click activity to determine user exposure
4. Soft delete the email if malicious
5. Block related indicators (domains, URLs, hashes)
6. Notify and educate affected users if interaction occurred

This enables early intervention before phishing escalates into credential theft or malware execution.

Many phishing defenses focus on delivery prevention. This detection focuses on post-delivery risk, where user interaction actually occurs.

By identifying structurally suspicious emails that: bypass filters, remain in inboxes, and receive no automated remediation, security teams gain visibility into a critical blind spot frequently exploited by modern attackers.

Microsoft Defender XDR

• Provides email delivery, attachment, URL, and post-delivery telemetry

Microsoft Sentinel

• Enables analytics, correlation, enrichment, and alerting across email signals

Microsoft 365

• The collaboration environment where user exposure occurs

Wizard Cyber specializes in behavior-driven detection engineering across Microsoft security platforms. We design analytics that focus on:

• Real user exposure, not just attempted attacks
• High signal-to-noise detections
• Actionable alerts with built-in investigation context

By combining deep platform expertise with practical threat modeling, we help organizations detect what automated controls miss, and respond before impact occurs.