Email threat hunting starts with an observable: a sender, domain, URL, attachment hash, subject pattern, message identifier, IP address or authentication anomaly.
Search across mail-flow telemetry and identity/security logs to determine scope.
Pivot carefully
A shared subject can produce false positives. A malicious domain may appear in a rewritten security URL. A compromised legitimate account can authenticate correctly.
Useful pivots include:
- sender and Reply-To;
- sending IP;
- URL/domain;
- attachment hash/name;
- Message-ID patterns;
- authentication results;
- recipients;
- mailbox-rule changes;
- sign-in events.