<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-email-threat-hunting
description: >-
  Proactively hunt for email-based threats including BEC campaigns, credential
  harvesting, lateral phishing, email forwarding persistence, and advanced
  phishing techniques using log analysis and behavioral patterns.
domain: cybersecurity
subdomain: email-security
tags:
  - threat-hunting
  - bec
  - phishing
  - lateral-movement
  - persistence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1534", "T1114", "T1098.002"]
  tools: [splunk, kql, python3, exchange-powershell, elastic]
---

# Performing Email Threat Hunting

## Overview

Email threat hunting proactively searches for undetected threats in email
logs, focusing on BEC patterns, credential harvesting indicators, lateral
phishing chains, persistence via mail rules, and evasive delivery techniques.

## Prerequisites

- Tools: Splunk, KQL, Exchange PowerShell, Elastic
- Access to email gateway logs and audit logs
- Threat intelligence feeds for IOC enrichment

## Key Concepts

- **BEC indicators**: Display name spoofing, urgency language, payment requests
- **Credential harvesting**: Links to fake login pages on non-corporate domains
- **Lateral phishing**: Compromised internal accounts sending phishing internally
- **Mail rule persistence**: Attackers creating rules to maintain access

## Workflow

### Step 1: BEC Pattern Hunting

```kql
// Display name spoofing of executives
EmailEvents
| where TimeGenerated > ago(7d)
| where SenderFromDomain != "example.com"
| where SenderDisplayName has_any ("CEO Name", "CFO Name")
| project TimeGenerated, SenderFromAddress, Subject, RecipientEmailAddress

// Payment/wire transfer urgency patterns
EmailEvents
| where TimeGenerated > ago(7d)
| where Subject has_any ("wire transfer", "urgent payment", "bank details", "invoice")
| where SenderFromDomain != "example.com"
```

### Step 2: Credential Harvesting Detection

```kql
// Links to non-corporate login pages
EmailUrlInfo
| where TimeGenerated > ago(7d)
| where Url has_any ("login", "signin", "verify", "authenticate")
| where Url !has "example.com"
| join kind=inner EmailEvents on NetworkMessageId

// Recently registered domain links
EmailUrlInfo
| where TimeGenerated > ago(7d)
| extend Domain = extract("https?://([^/]+)", 1, Url)
| join kind=inner (
    ThreatIntelligenceIndicator
    | where DomainCreatedDate > ago(30d)
) on Domain
```

### Step 3: Lateral Phishing Hunt

```kql
// Internal sender to many recipients with links
EmailEvents
| where TimeGenerated > ago(24h)
| where SenderFromDomain == "example.com"
| where EmailDirection == "Intra-org"
| summarize Recipients=dcount(RecipientEmailAddress) by SenderFromAddress, Subject
| where Recipients > 20

// Internal sender with attachment to many recipients
EmailAttachmentInfo
| where TimeGenerated > ago(24h)
| join kind=inner EmailEvents on NetworkMessageId
| where SenderFromDomain == "example.com"
| summarize count() by SenderFromAddress, FileName
| where count_ > 10
```

### Step 4: Persistence via Mail Rules

```kql
// Hunt for suspicious inbox rules created recently
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend RuleParams = tostring(Parameters)
| where RuleParams has_any ("ForwardTo", "RedirectTo", "DeleteMessage")
| project TimeGenerated, UserId, Operation, RuleParams
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Executive spoofing | Gateway logs | External mail with executive display names |
| Credential phishing | URL logs | Links to login pages on new domains |
| Lateral phishing | Email logs | Internal bulk sends with suspicious content |
| Rule-based persistence | Audit logs | Inbox rules forwarding or deleting |

```yaml
title: Email Forwarding Rule to External Address
id: e1f2a3b4-c5d6-7890-e012-123456789abc
status: experimental
description: Detects inbox rules forwarding email to external addresses
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation: "New-InboxRule"
    Parameters|contains: "ForwardTo"
  filter:
    Parameters|contains: "example.com"
  condition: selection and not filter
falsepositives:
  - Legitimate external forwarding approved by IT
level: high
tags:
  - attack.t1114.002
  - attack.collection
```

## Verification

- [ ] BEC pattern queries deployed and returning results
- [ ] Credential harvesting URL detection active
- [ ] Lateral phishing detection for internal bulk sends
- [ ] Mail rule persistence hunting queries operational
- [ ] Findings triaged and escalated per playbook

## References

- [MITRE T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE T1534 — Internal Spearphishing](https://attack.mitre.org/techniques/T1534/)
- [Microsoft Threat Hunting](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview)
