Microsoft 365 mail outbound fanout
One mailbox sent to an unusual number of DISTINCT recipients in a short window.
What it detects
One mailbox sent to an unusual number of DISTINCT recipients in a short window.
This is what a compromised mailbox is used for once the attacker has it. The account is trusted — it has the organisation's domain, its signature, and its existing conversation threads — so it is the ideal place to send the next round of lures from. Internally it spreads the compromise; externally it defrauds the organisation's own customers and suppliers, who have every reason to believe the mail.
Counted as DISTINCT recipients rather than messages, because message trace writes one row per recipient: a single message to 60 people is 60 rows, and counting rows would make an ordinary all-staff announcement look identical to a spray. Breadth of correspondents is the signal; volume alone is not.
MITRE ATT&CK mapping
False positives and triage
Perfectly ordinary things reach 40 recipients in 15 minutes: an all-staff announcement, a newsletter, a distribution list that expands, a ticketing or monitoring mailbox, a mail-merge from marketing. Any shared or automated mailbox will exceed this routinely.
What separates a spray from a broadcast:
* **Who the recipients are.** A broadcast goes to the organisation's own people or to a stable customer list; a spray goes to addresses with no prior relationship, often harvested from the mailbox's own contacts. * **Whether the sender does this normally.** The first time an accounts-payable mailbox sends to 200 people is the finding; the hundredth time a marketing mailbox does is the job. * **What preceded it.** A risky sign-in, a new inbox rule, or a registered authentication method in the hours before turns this from noisy to urgent.
The count of 40 in 15 minutes is set for small-to-mid tenants. A large tenant, or one with busy shared mailboxes, should raise it after measuring its own baseline — and should consider suppressing its known bulk senders by name rather than weakening the threshold for everyone.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_mail_outbound_fanout.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mail_outbound_fanout
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1534, T1114, T1566.002]
description: |
One mailbox sent to an unusual number of DISTINCT recipients in a short window.
This is what a compromised mailbox is used for once the attacker has it. The
account is trusted — it has the organisation's domain, its signature, and its
existing conversation threads — so it is the ideal place to send the next round
of lures from. Internally it spreads the compromise; externally it defrauds the
organisation's own customers and suppliers, who have every reason to believe
the mail.
Counted as DISTINCT recipients rather than messages, because message trace
writes one row per recipient: a single message to 60 people is 60 rows, and
counting rows would make an ordinary all-staff announcement look identical to a
spray. Breadth of correspondents is the signal; volume alone is not.
match:
provider: Office365
event_action_contains_any:
- message_delivered
- message_expanded
threshold:
distinct: target_user_name
count: 40
window_seconds: 900
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Perfectly ordinary things reach 40 recipients in 15 minutes: an all-staff
announcement, a newsletter, a distribution list that expands, a ticketing or
monitoring mailbox, a mail-merge from marketing. Any shared or automated mailbox
will exceed this routinely.
What separates a spray from a broadcast:
* **Who the recipients are.** A broadcast goes to the organisation's own
people or to a stable customer list; a spray goes to addresses with no prior
relationship, often harvested from the mailbox's own contacts.
* **Whether the sender does this normally.** The first time an accounts-payable
mailbox sends to 200 people is the finding; the hundredth time a marketing
mailbox does is the job.
* **What preceded it.** A risky sign-in, a new inbox rule, or a registered
authentication method in the hours before turns this from noisy to urgent.
The count of 40 in 15 minutes is set for small-to-mid tenants. A large tenant,
or one with busy shared mailboxes, should raise it after measuring its own
baseline — and should consider suppressing its known bulk senders by name
rather than weakening the threshold for everyone.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.