Listen to this Post
Introduction
Phishing campaigns leveraging Microsoft Exchange’s Direct Send feature are on the rise, allowing attackers to bypass traditional email security measures. These emails appear legitimate, making detection challenging. In this article, we’ll explore how to identify and block these threats using KQL (Kusto Query Language) in Microsoft Defender XDR and Sentinel.
Learning Objectives
- Understand how Direct Send phishing attacks work.
- Learn to deploy a KQL query to detect suspicious emails.
- Implement mitigation strategies to secure your Exchange environment.
You Should Know
1. How Direct Send Phishing Works
Direct Send is a legitimate Microsoft Exchange feature that allows applications to send emails without authentication. Attackers abuse this by spoofing internal domains, making emails appear as if they originate from trusted sources.
Detection Query (KQL):
EmailEvents | where SenderFromDomain == "yourdomain.com" | where SenderMailFromDomain != "yourdomain.com" | where EmailDirection == "Inbound" | project Timestamp, Subject, SenderFromAddress, SenderMailFromAddress
Steps:
- Run this query in Microsoft Defender XDR or Sentinel.
2. Replace `”yourdomain.com”` with your organization’s domain.
- Review results for mismatched sender domains—a key indicator of Direct Send abuse.
2. Blocking Direct Send Abuse
To prevent exploitation, restrict Direct Send permissions in Exchange Online.
PowerShell Command:
Set-TransportConfig -Identity Default -DirectSendEnabled $false
Steps:
1. Open Exchange Online PowerShell.
- Run the command to disable Direct Send globally.
- Alternatively, restrict Direct Send to specific IPs using:
Set-TransportConfig -Identity Default -DirectSendIPAllowList "192.168.1.1"
3. Enhancing Email Security with Mail Flow Rules
Create a mail flow rule to flag or block emails with mismatched sender domains.
Exchange Admin Center Steps:
1. Navigate to Mail flow > Rules.
2. Create a new rule with the condition:
- Sender domain is: `yourdomain.com`
- Sender IP address is not: `[Your trusted IPs]`
3. Set the action to Block the message.
4. Monitoring with Defender for Office 365
Leverage Defender’s threat intelligence to detect anomalies.
KQL Query for Advanced Hunting:
EmailAttachmentInfo | where FileType == "html" or FileType == "htm" | where FileName contains "login" or FileName contains "password" | join EmailEvents on NetworkMessageId | where SenderFromDomain != SenderMailFromDomain
Steps:
- This query detects phishing emails with malicious attachments.
- Refine based on your organization’s typical email patterns.
5. Educating Users on Phishing Red Flags
Human vigilance is critical. Train users to spot:
- Mismatched sender addresses.
- Urgent or suspicious requests.
- Unusual attachments or links.
What Undercode Say
- Key Takeaway 1: Direct Send phishing exploits a legitimate feature, making it harder to detect with traditional filters. Proactive monitoring with KQL is essential.
- Key Takeaway 2: Disabling or restricting Direct Send and implementing mail flow rules significantly reduces risk.
Analysis:
As attackers evolve, defenders must combine technical controls (like KQL hunting) with administrative safeguards (e.g., Exchange hardening). The shared GitHub repository (HybridBrothers/Hunting-Queries-Detection-Rules) provides actionable queries, but organizations must adapt them to their environments. Future attacks may target other Exchange features, so continuous monitoring and user training are paramount.
Prediction
Expect a surge in Direct Send phishing as attackers pivot from blocked methods. Organizations adopting zero-trust email policies (e.g., DMARC/DKIM) and automated KQL-based detection will stay ahead. Microsoft may also introduce native Direct Send security enhancements in response to rising abuse.
IT/Security Reporter URL:
Reported By: Robbe Van – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
