Multiple Phishing Emails Bypassing ATP

Question

Multiple Phishing Emails Bypassing ATP

Abdul Waqas 345

We are currently under an active and ongoing phishing/spam campaign that has been continuously targeting our organization for the past several days. Despite having Microsoft Defender for Office 365 Plan 2 fully enabled and correctly configured security policies in place, these malicious emails are consistently bypassing all protections and reaching end users.

🚨 Critical Observations:

Emails are being received daily at a consistent time window

The subject remains identical, indicating a coordinated campaign

The sender domains are changing continuously every day (domain rotation attack)

Emails are successfully bypassing Microsoft Defender for Office 365 filtering

Multiple users across the organization are being affected

⚠️ Security Controls Already in Place:

Microsoft Defender for Office 365 Plan 2 enabled

Anti-phishing policies configured and active

Anti-spam policies enabled

Mail flow rules implemented for temporary blocking

Manual domain blocking is being performed daily

Despite all of the above controls, the attack is still not being stopped effectively.

0 comments

Answer accepted by question author

Derek Morgan II 85

Hi @Abdul Waqas

The earlier answer is thorough, so I'll just add what tends to actually crack a rotating campaign.

Domain rotation beats domain blocking by design, so stop chasing the sender domain and pin the invariant instead. The subject and the sending infrastructure usually stay constant even as the domain changes. Block the payload URL on the URLs tab and the attachment's SHA256 on the Files tab of the Tenant Allow/Block List, and block the sending IPv4 in the connection filter policy (TABL only takes IPv6, and it doesn't do ASN).

Before tuning anything, confirm nothing is forcing delivery: a TABL allow entry, Outlook Safe Senders, or a transport rule setting SCL -1. A campaign clearing correctly configured policy is usually an override.

Then hunt for the pattern and the reason it lands:

EmailEvents
| where Timestamp > ago(7d)
| where DeliveryAction == "Delivered"
| summarize Count=count(), Domains=dcount(SenderMailFromDomain),
            IPs=make_set(SenderIPv4, 10)
        by Subject, EmailActionPolicy, ConfidenceLevel
| order by Count desc

Many domains but few IPs gives you the invariant to block. ConfidenceLevel -1 or a transport rule in EmailActionPolicy is your bypass.

Keep users reporting so submissions train the filter.

0 comments

1 additional answer

Your answer

Answer 1

Use a combination of tuning, stronger policies, and proper reporting so Microsoft’s filters learn from these messages and block the campaign without relying on daily manual domain blocks.

Contain and investigate the current campaign
Identify all affected users and messages:
- In Defender for Office 365 Plan 2, use Threat Explorer/real‑time detections and Campaign views to see all messages in this coordinated campaign, including rotating domains and senders. For campaigns, see Campaign Views in Microsoft Defender for Office 365.
- If any accounts are compromised, follow the steps in Responding to a compromised cloud email account.
Remove malicious emails from mailboxes:
- Use Defender for Office 365 investigation and response capabilities (e.g., Explorer, ZAP, and remediation actions) to soft‑delete or quarantine all campaign messages from user mailboxes.
Ensure users are reporting:
- Instruct users to report these emails as Phishing using the built‑in Report button in Outlook. This feeds the Submissions pipeline and helps tune filters. See Use the built-in report button in Outlook.
- Admins should triage these from the User reported tab on the Submissions page and submit them to Microsoft as phish. See View user reported messages to Microsoft.
Submit samples directly to Microsoft:
- From the Submissions page, submit representative messages from this campaign as phish so Microsoft can analyze why they were allowed and adjust back‑end filters. See Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft.
- When submitting, consider creating a block entry for the sender/domain if it is stable enough to be useful. See Create block entries for domains and email addresses.
Tune anti-phishing and related protection
Increase phishing sensitivity:
- In the relevant Defender for Office 365 anti‑phishing policy, temporarily increase the Phishing email threshold from Standard to Aggressive, More aggressive, or Most aggressive to better catch this campaign. See Configure anti-phishing policies in Microsoft Defender for Office 365 and Phishing email thresholds in anti-phishing policies in Microsoft Defender for Office 365.
- Monitor for false positives and adjust as needed.
Enable and tune impersonation protection:
- Ensure impersonation protection is enabled for:
  - High‑value users (executives, finance, IT, etc.).
  - Key internal domains and trusted external domains.
- Configure mailbox intelligence so the system learns normal communication patterns and flags anomalous sender behavior. See Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365 and Impersonation insight in Defender for Office 365.
Verify Safe Links and Safe Attachments coverage:
- Confirm Safe Links and Safe Attachments policies are enabled and scoped to all users, not just subsets, and that they are in blocking mode (not just audit) for production. See:
  - Safe Links in Microsoft Defender for Office 365
  - Safe Attachments in Microsoft Defender for Office 365
- Ensure preset security policies (Built‑in protection) are enabled so default protections apply to all recipients. See Preset security policies.
Avoid over‑allowing that bypasses filters:
- Review and minimize use of:
  - Tenant allow entries for domains/addresses.
  - Allowed sender/domain lists in anti‑spam policies.
  - Outlook Safe Senders lists that might bypass spoof/anti‑phish.
- Overly broad allowlists can let high‑confidence phish through. Microsoft recommends avoiding allowed sender/domain lists where possible. See Use allowed sender lists or allowed domain lists and Outlook Safe Senders.
Harden authentication and spoof protection
Ensure SPF, DKIM, and DMARC are correctly configured for all domains:
- Proper email authentication lets Microsoft 365 more accurately detect spoofing and phishing, especially in domain‑rotation attacks. See Email authentication.
Review anti‑spoofing settings:
- Confirm anti‑spoofing protection is enabled in anti‑phishing policies and not bypassed by allowlists. See Anti-spoofing protection in anti-phishing policies and Anti-spoofing protection for cloud mailboxes.
Improve long-term resilience
Use Campaign Views and reports:
- Use Campaign Views to understand the full scope of the attack, delivery paths, and which controls are effective. See Campaign Views in Microsoft Defender for Office 365.
- Use Defender for Office 365 reports and the Email entity page to track detection and remediation over time. See Defender for Office 365 reports and The Email entity page.
Leverage user education and simulations:
- Run targeted phishing simulations against similar lures to train users to recognize and report them quickly. See Get started using Attack simulation training.
Handle future false negatives systematically:
- Follow the guidance in “How to handle malicious emails that are delivered to recipients (false negatives)”:
  - Ensure users report via the Report button.
  - Admins triage user‑reported messages.
  - Submit to Microsoft for analysis and create block entries where appropriate.
  - Use the submission verdicts to adjust policies and thresholds. See How to handle malicious emails that are delivered to recipients (false negatives) using Microsoft Defender for Office 365.

By combining higher phishing thresholds, fully enabled impersonation/Safe Links/Safe Attachments, strict control of allowlists, robust email authentication, and consistent reporting/submission of these campaign messages, Defender for Office 365 Plan 2 can learn from the current attack and significantly reduce or stop similar messages from reaching end users.

References: