Scam Detection Playbook
Introduction: The Need for Effective Scam Email Detection Capabilities
Scam emails remain a significant cybersecurity threat, targeting individuals and organisations with fraudulent schemes designed to steal sensitive information, financial assets, or login credentials. Cybercriminals use tactics such as impersonation, fake invoices, lottery scams, tech support fraud, and investment scams to deceive recipients into taking malicious actions. As scam emails become more sophisticated—often bypassing traditional spam filters and leveraging social engineering—organisations need advanced detection capabilities to prevent financial losses, data breaches, and reputational damage.
Effective scam email detection capabilities and processes are essential for identifying and mitigating fraudulent communications before they compromise users or systems. A comprehensive detection strategy should incorporate advanced email filtering, machine learning-based anomaly detection, domain reputation analysis, and integration with threat intelligence feeds to recognise scam indicators in real-time. Security solutions such as Security Email Gateways (SEGs), Security Information and Event Management (SIEM), and behavioural analytics enhance the ability to detect unusual email patterns, sender spoofing, and embedded phishing links.
To effectively combat scam email threats, organisations must implement continuous monitoring, automated alerts, and user education programs to improve awareness of scam tactics. By strengthening detection and response mechanisms, security teams can proactively identify fraudulent emails, reduce the risk of financial and operational impact, and enhance overall cybersecurity resilience.
Table of Contents
Initial Detection of Scam Activity
Identify Scam Emails
Detect Unusual Click Activity on Scam URLs
Monitor Unusual Outbound Network Traffic
Compromised Account Indicators
Login from Unusual Locations
Suspicious Email Rule Creation
Abnormal Authentication Patterns
Financial and Data Theft Indicators
Monitor Unusual File Access
Detect Outbound Data Transfers
Identify Use of Financial Manipulation Tools
Threat Persistence
Persistent Email Rules
OAuth Application Abuse
Advanced Indicators of Credential Abuse
Incident Response and Containment
Isolate Compromised Accounts and Systems
Identify Indicators of Compromise (IoCs)
Timeline Reconstruction
Conclusion
This playbook provides a structured approach to detecting and analysing scam compromises within an organisation using Microsoft Defender and Sentinel. Each section includes advanced KQL queries with descriptions and expected results.
1. Initial Detection of Scam Activity
Query Option 1: Identify Scam Emails
Description: Identifies emails with suspicious subjects or domains commonly associated with scams. Results include sender details, recipients, and IP addresses.
Query Option 2: Detect Unusual Click Activity on Scam URLs
Description: Detects users clicking on shortened or suspicious URLs multiple times, which may indicate interaction with scam links. Results display users and URLs.
Query Option 3: Monitor Unusual Outbound Network Traffic
Description: Monitors devices generating a high volume of outbound requests to public IPs, potentially to scam domains. Results highlight affected devices and IPs.
2. Compromised Account Indicators
Query Option 1: Login from Unusual Locations
Description: Detects logins from unexpected geolocations. Results include user accounts, locations, and IP addresses.
Query Option 2: Suspicious Email Rule Creation
Description: Flags email forwarding rules to external domains, a common indicator of account compromise. Results display affected users and rule details.
Query Option 3: Abnormal Authentication Patterns
Description: Identifies repeated authentication failures using unexpected methods. Results highlight affected users and associated IPs.
3. Financial and Data Theft Indicators
Query Option 1: Monitor Unusual File Access
Description: Tracks high-volume file access in sensitive folders, such as finance or payroll directories. Results display devices and users involved.
Query Option 2: Detect Outbound Data Transfers
Description: Identifies significant outbound data transfers, potentially indicating exfiltration. Results include source devices and destination IPs.
Query Option 3: Identify Use of Financial Manipulation Tools
Description: Flags processes that may indicate financial data manipulation. Results include process details and associated accounts.
4. Threat Persistence
Query Option 1: Persistent Email Rules
Description: Detects persistent email forwarding rules. Results include rule names and associated accounts.
Query Option 2: OAuth Application Abuse
Description: Identifies unauthorized OAuth application approvals. Results include app details and affected accounts.
Query Option 3: Advanced Indicators of Credential Abuse
Description: Flags token-based authentication for sensitive accounts, potentially indicating abuse. Results include accounts and IPs.
5. Incident Response and Containment
Query Option 1: Isolate Compromised Accounts and Systems
Description: Tracks recent activity for known compromised accounts. Results help in isolating accounts.
Query Option 2: Identify Indicators of Compromise (IoCs)
Description: Correlates IoCs with email, file, and process events. Results display impacted devices and files.
Query Option 3: Timeline Reconstruction
Description: Combines data sources to create a comprehensive timeline of scam-related activities. Results provide a detailed incident overview.
6. Conclusion
The playbook offers a good approach to detecting and analysing compromises in an environment. However, its usefulness depends on the environment and tools at your disposal. For an environment where KQL is an option, the queries may require some adaptation to specific data sources and infrastructure setup.
Last updated