T1667

Email Bombing

Impact Last updated:

This detection identifies email bombing attacks where adversaries flood targeted mailboxes with high volumes of inbound messages to disrupt operations, bury legitimate security alerts, or distract victims from concurrent malicious activity. The detection monitors for abnormal spikes in inbound email volume to specific recipients within short time windows, particularly identifying patterns consistent with automated list-subscription bombing (many unique senders, low-value content, rapid delivery) versus legitimate bulk mail. Email bombing is frequently observed as a precursor to vishing attacks where threat actors (notably Storm-1811) follow up with fraudulent IT support calls, making timely detection critical for preventing downstream credential theft or ransomware deployment.

What is T1667 Email Bombing?

Email Bombing (T1667) maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data in MITRE ATT&CK.

This page provides production-ready detection logic for Email Bombing, covering the data sources and telemetry it touches: Microsoft Defender for Office 365. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Impact
Technique
T1667 Email Bombing
Canonical reference
https://attack.mitre.org/techniques/T1667/
Microsoft Sentinel / Defender
kusto 
let VolumeThreshold = 100;
let TimeWindow = 30min;
let LookbackPeriod = 2h;
EmailEvents
| where Timestamp > ago(LookbackPeriod)
| where EmailDirection == "Inbound"
| where DeliveryAction != "Blocked"
| summarize
    EmailCount = count(),
    UniqueSenders = dcount(SenderFromAddress),
    UniqueDomains = dcount(SenderFromDomain),
    SenderDomainSamples = make_set(SenderFromDomain, 20),
    SubjectSamples = make_set(Subject, 10),
    FirstMessageTime = min(Timestamp),
    LastMessageTime = max(Timestamp)
    by RecipientEmailAddress, bin(Timestamp, TimeWindow)
| where EmailCount >= VolumeThreshold
| extend
    EmailsPerMinute = round(toreal(EmailCount) / 30.0, 2),
    SenderDiversityRatio = round(toreal(UniqueSenders) / toreal(EmailCount), 3),
    BurstDurationMinutes = datetime_diff('minute', LastMessageTime, FirstMessageTime)
| extend
    BombingIndicator = case(
        UniqueSenders >= 50 and EmailCount >= 200, "High Confidence - List Subscription Bombing",
        UniqueSenders >= 20 and EmailCount >= 100, "Medium Confidence - Automated Bombing",
        UniqueSenders < 5 and EmailCount >= 100, "Low Confidence - Single Source Flood",
        "Anomalous Volume"
    )
| project
    WindowStart = Timestamp,
    RecipientEmailAddress,
    EmailCount,
    UniqueSenders,
    UniqueDomains,
    EmailsPerMinute,
    SenderDiversityRatio,
    BurstDurationMinutes,
    BombingIndicator,
    SubjectSamples,
    SenderDomainSamples
| order by EmailCount desc

Detects email bombing attacks by monitoring inbound email volume spikes per recipient within 30-minute windows using Microsoft Defender for Office 365 EmailEvents data. Identifies list-subscription bombing patterns (high sender diversity, high volume) and single-source flooding. Classifies confidence based on sender diversity ratios characteristic of automated newsletter registration bots versus targeted spam campaigns.

high severity medium confidence

Data Sources

Microsoft Defender for Office 365

Required Tables

EmailEvents

False Positives

  • Large marketing campaigns or product launches where the organization receives legitimate high-volume replies or registrations
  • IT monitoring systems generating notification floods due to alerting misconfiguration or infrastructure incidents affecting many monitored systems simultaneously
  • Users who have voluntarily subscribed to multiple high-volume newsletters or mailing lists (adjust threshold or add recipient exclusions for known high-volume users)
  • Internal all-hands or organization-wide email distributions that generate large reply volumes
  • Conference or event registration confirmations and subsequent mailing list enrollments following legitimate user sign-ups

Sigma rule & cross-platform mapping

The detection logic for Email Bombing (T1667) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1667 Sigma rules on detection.fyi

Platform-specific guides for T1667

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-03-20 Research depth: deep
References (3)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Email Bombing via PowerShell SMTP Flood to Test Mailbox

    Expected signal: EmailEvents table in Microsoft Defender for Office 365 will show 150 inbound messages to [email protected] within a 10-minute window. OfficeActivity logs will reflect delivery events.

  2. Test 2List Subscription Bombing Simulation via Curl (Linux)

    Expected signal: Network proxy logs will show repeated POST requests to external web endpoints from the test host. Email gateway logs will reflect inbound confirmation messages from diverse sender domains if real newsletter endpoints are used.

  3. Test 3Validate Vishing Precursor Pattern — Email Bomb + RAT Execution Sequence

    Expected signal: Sysmon Event ID 1 will capture anydesk.exe process creation with parent process, command line, and user context. DeviceProcessEvents in Microsoft Defender will record the process. Combined with synthetic email bombing telemetry, the hunting query should correlate the two events.

Response Playbook

Triage

  1. Step 1: Identify the targeted recipient(s) from the alert. Cross-reference against privileged account lists (executives, IT admins, finance), security team members, and help desk staff — high-value targets suggest a coordinated attack rather than indiscriminate harassment.
  2. Step 2: Pull a sample of 20-30 emails from the bombing window. Examine subject lines, sender domains, and message bodies. List-subscription bombing will show diverse senders (newsletter confirmations, service sign-up notices); single-source floods will have repetitive content from few domains.
  3. Step 3: Check the timing of the email bombing onset. Query email logs for 30-60 minutes prior to the bombing start to identify any preceding spearphishing, reconnaissance emails, or unusual login activity from the targeted account.
  4. Step 4: Verify whether the targeted user has received any follow-up phone calls or vishing attempts by checking the user's calendar (Teams/Outlook) and contacting them or their manager directly. Storm-1811 and similar groups follow email bombing with fraudulent IT support calls within minutes to hours.
  5. Step 5: Check Azure AD / Entra ID sign-in logs for the targeted recipient during and after the bombing window. Look for sign-ins from new locations, new devices, MFA prompts accepted, or conditional access policy bypasses that could indicate the vishing call succeeded.
  6. Step 6: Review Microsoft Defender for Office 365 threat explorer for any phishing or malware emails delivered in the same time window that may have slipped through under cover of the email flood.
  7. Step 7: Determine if the targeted user's mailbox has auto-forwarding rules, inbox rules, or delegate access that was recently modified — a successful vishing/RAT session may include creating persistence mechanisms in the mailbox.

Containment

  1. If vishing compromise is suspected, immediately reset the targeted user's credentials and revoke all active sessions via Azure AD: Entra ID > Users > [user] > Revoke sessions, followed by password reset.
  2. Enable mail flow rules in Exchange Online to rate-limit inbound messages to the targeted recipient from external senders, or temporarily quarantine high-volume inbound mail for manual review while the bombing is active.
  3. If remote access software (AnyDesk, TeamViewer, Quick Assist) was installed during a vishing call, isolate the endpoint via Microsoft Defender: Security Center > Device inventory > Isolate device.
  4. Block identified sender domains and IP ranges at the email gateway if single-source or identifiable campaign infrastructure is detected — use Exchange Online Protection connection filtering or Defender for Office 365 tenant block lists.
  5. Alert the targeted user and their manager via a verified out-of-band channel (phone call, Teams message from IT's verified account) — do not use email, which may be lost in the flood. Instruct them not to accept unsolicited IT support calls or grant remote access.

Evidence Collection

  1. Export all emails received by the targeted recipient during the bombing window: Exchange Online PowerShell — Get-MessageTrace -RecipientAddress [email] -StartDate [start] -EndDate [end] | Export-Csv. Preserve message headers, sender IPs, and delivery timestamps.
  2. Pull Azure AD sign-in logs for the affected user for 24 hours surrounding the bombing event: Entra ID > Sign-in logs, filter by user UPN. Export to CSV. Note: legacy authentication sign-ins (IMAP/POP3/SMTP AUTH) appear in 'Non-interactive sign-ins'.
  3. Collect Microsoft Defender for Endpoint process creation timeline for the targeted endpoint if a vishing/RAT session is suspected: Advanced Hunting > DeviceProcessEvents where DeviceName == [hostname] and Timestamp between [start] and [end].
  4. Capture any new inbox rules created in the targeted mailbox: Exchange Online PowerShell — Get-InboxRule -Mailbox [email] | Select Name, Description, Enabled, ForwardTo, DeleteMessage, RedirectTo. Document creation timestamps.
  5. If remote access software is suspected, collect installed application logs, prefetch files (C:\Windows\Prefetch\ANYDESK*.pf, TEAMVIEWER*.pf), and Windows Event Log entries: System Event ID 7045 (service install), Security Event ID 4688 (process create for anydesk.exe, quick_assist.exe).
  6. Export Microsoft Defender for Office 365 email threat data for the bombing window via Security portal > Explorer, filtering to the targeted recipient. Download all message metadata including sender authentication results (SPF/DKIM/DMARC pass/fail).

Escalation Criteria

  • ! Escalate immediately to incident response if the targeted user reports receiving a phone call from someone claiming to be IT support during or after the email bombing — this is the Storm-1811 vishing pattern with high probability of active compromise.
  • ! Escalate if Azure AD sign-in logs show successful authentication from a new device or location during the bombing window, especially if followed by MFA approval — indicates credentials may have been harvested during a vishing call.
  • ! Escalate if remote access software (AnyDesk, TeamViewer, Quick Assist, ScreenConnect) is found installed or executed on the targeted endpoint — ransomware deployment or credential theft may be in progress.
  • ! Escalate if the targeted user is an executive, CFO, IT administrator, or has privileged access to financial systems, HR platforms, or production infrastructure — high-value targeting combined with email bombing indicates a sophisticated threat actor.
  • ! Escalate if lateral movement indicators appear within 4 hours of the bombing onset: new admin account creation (Security Event 4720), privilege escalation (4672), or unusual authentication to other systems from the targeted user's credentials.

Investigation Guide

Forensic Artifacts

  • > Exchange Online message trace logs: sender IPs, authentication results, delivery timestamps for all messages in bombing window
  • > Azure AD sign-in logs: authentication events for targeted user during and after bombing period, including MFA challenge/response
  • > Microsoft Defender for Office 365 email entity pages: full headers, routing hops, sender reputation scores for sampled bombing messages
  • > Windows prefetch files: C:\Windows\Prefetch\ANYDESK*.pf, TEAMVIEWER*.pf, MSRA*.pf (Quick Assist), SCREENCONNECT*.pf for evidence of remote access tools
  • > Exchange Online inbox rules: creation timestamps, conditions, and actions for any rules created during or after bombing window
  • > O365 Unified Audit Log: mailbox access events, OAuth token grants, application permission changes during bombing window
  • > Endpoint process creation events (Sysmon Event ID 1 or Security 4688): parent-child process chains for any remote access or credential harvesting tools
  • > Microsoft Teams or phone system call detail records: incoming call timestamps to targeted user matching the vishing follow-up window

Tuning Guidance

Tune the EmailCount threshold (default 100 per 30 minutes) based on organization baseline. Run the query in monitor mode for 2 weeks and establish the 99th percentile for legitimate recipients. Shared mailboxes like helpdesk@, support@, and info@ addresses naturally receive high volumes and should be excluded or given elevated thresholds. Executive assistants managing high-volume correspondence may require per-user tuning. Consider creating a watchlist of high-value targets (executives, finance staff, IT admins) for whom lower thresholds are appropriate given their role in follow-on attacks. The SenderDiversityRatio field is key for distinguishing list-subscription bombing (ratio near 1.0, many unique senders) from legitimate bulk mail (lower ratio). Set scheduled alert suppression windows around known marketing campaign periods or product launch days where reply volumes spike legitimately.

Hunting Queries

Hunts for email bombing events followed by successful authentication within 2 hours — the key indicator of a Storm-1811-style vishing attack where email flooding is used to distract the victim while credentials are stolen via phone

Hunting — KQL
kql 
// Hunt for email bombing followed by successful authentication anomalies (vishing indicator)
let BombingWindows = EmailEvents
    | where Timestamp > ago(7d)
    | where EmailDirection == "Inbound"
    | summarize EmailCount = count(), UniqueSenders = dcount(SenderFromAddress) by RecipientEmailAddress, HourWindow = bin(Timestamp, 1h)
    | where EmailCount >= 50
    | project RecipientEmailAddress, BombingStart = HourWindow, BombingEnd = datetime_add('hour', 2, HourWindow);
BombingWindows
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where ResultType == 0
    | project
        UserPrincipalName,
        SigninTime = TimeGenerated,
        IPAddress,
        Location,
        DeviceDetail,
        IsInteractive,
        MfaDetail = tostring(MfaDetail),
        ConditionalAccessStatus
) on $left.RecipientEmailAddress == $right.UserPrincipalName
| where SigninTime between (BombingStart .. BombingEnd)
| project BombingStart, RecipientEmailAddress, SigninTime, IPAddress, Location, DeviceDetail, MfaDetail, ConditionalAccessStatus
| order by BombingStart desc
Hunting — SPL
spl 
index=* (sourcetype="o365:management:activity" OR sourcetype="ms:o365:defender:emailevents")
| search (Operation="Receive" OR RecordType="ExchangeItem")
| eval recipient=coalesce('RecipientEmailAddress', 'MailboxOwnerUPN')
| bucket _time span=1h
| stats count as EmailCount, dc(SenderEmailAddress) as UniqueSenders by _time, recipient
| where EmailCount >= 50
| eval BombingEnd=_time+7200
| join type=inner recipient [
    search index=* sourcetype="o365:management:activity" Operation="UserLoggedIn" OR Operation="PasswordLogonInitialAuthUsingPassword"
    | eval recipient='UserId'
    | table _time, recipient, ClientIP, UserAgent, ResultStatus
]
| where _time >= _time AND _time <= BombingEnd
| eval SuccessfulLogin=if(ResultStatus=="Succeeded", 1, 0)
| stats sum(SuccessfulLogin) as SuccessfulLogins, values(ClientIP) as LoginIPs by recipient, BombingHour
| where SuccessfulLogins > 0
| sort - EmailCount

Hunts for remote access tool (RAT) execution on endpoints belonging to email bombing targets within 4 hours of the bombing onset — direct evidence of vishing attack success where adversary gained remote control after social engineering

Hunting — KQL
kql 
// Hunt for remote access software installation following email bombing windows
let BomberTargets = EmailEvents
    | where Timestamp > ago(7d)
    | where EmailDirection == "Inbound"
    | summarize EmailCount = count() by RecipientEmailAddress, HourWindow = bin(Timestamp, 1h)
    | where EmailCount >= 80
    | project RecipientEmailAddress, BombingStart = HourWindow;
let RATProcesses = dynamic(["anydesk.exe", "teamviewer.exe", "teamviewer_service.exe", "quickassist.exe", "msra.exe", "screenconnect.exe", "connectwisecontrol.exe", "logmein.exe", "atera_agent.exe", "rustdesk.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (RATProcesses)
| extend ProcessedUser = tolower(AccountUpn)
| join kind=inner BomberTargets on $left.ProcessedUser == $right.RecipientEmailAddress
| where Timestamp between (BombingStart .. datetime_add('hour', 4, BombingStart))
| project
    BombingStart,
    RATLaunchTime = Timestamp,
    TargetUser = RecipientEmailAddress,
    DeviceName,
    ProcessName = FileName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine
| order by BombingStart desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ProcessName=lower(Image)
| search ProcessName IN ("*anydesk.exe", "*teamviewer.exe", "*quickassist.exe", "*screenconnect.exe", "*rustdesk.exe", "*atera_agent.exe", "*logmein.exe")
| eval AccountUPN=lower(User)
| join type=inner AccountUPN [
    search index=* (sourcetype="o365:management:activity" OR sourcetype="ms:o365:defender:emailevents")
    | search (Operation="Receive" OR RecordType="ExchangeItem")
    | eval AccountUPN=lower(coalesce('RecipientEmailAddress', 'MailboxOwnerUPN'))
    | bucket _time span=1h
    | stats count as EmailCount by _time, AccountUPN
    | where EmailCount >= 80
    | rename _time as BombingHour
]
| where _time >= BombingHour AND _time <= (BombingHour + 14400)
| table BombingHour, _time, AccountUPN, ProcessName, CommandLine, ParentImage
| sort - BombingHour

Hunts for malicious inbox rule creation (forwarding, deletion, redirect rules) correlated with recent email bombing of the same mailbox — a common post-vishing persistence technique where adversaries create rules to hide security notifications or exfiltrate email

Hunting — KQL
kql 
// Hunt for mailbox inbox rule creation during email bombing — persistence mechanism after vishing
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend RuleDetails = parse_json(Parameters)
| extend
    ForwardTo = tostring(RuleDetails[?(@.Name=="ForwardTo")].Value),
    DeleteMessage = tostring(RuleDetails[?(@.Name=="DeleteMessage")].Value),
    RedirectTo = tostring(RuleDetails[?(@.Name=="RedirectTo")].Value),
    SubjectContains = tostring(RuleDetails[?(@.Name=="SubjectContainsWords")].Value)
| where ForwardTo != "" or DeleteMessage =~ "True" or RedirectTo != ""
| join kind=leftouter (
    EmailEvents
    | where Timestamp > ago(7d)
    | where EmailDirection == "Inbound"
    | summarize EmailCount = count() by RecipientEmailAddress, HourWindow = bin(Timestamp, 1h)
    | where EmailCount >= 50
) on $left.UserId == $right.RecipientEmailAddress
| project
    TimeGenerated,
    UserId,
    ClientIP,
    Operation,
    ForwardTo,
    DeleteMessage,
    RedirectTo,
    SubjectContains,
    ConcurrentBombingVolume = EmailCount
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype="o365:management:activity" (Operation="New-InboxRule" OR Operation="Set-InboxRule" OR Operation="UpdateInboxRules")
| eval RuleUser=lower(UserId)
| eval HasForward=if(like(Parameters, "%ForwardTo%"), 1, 0)
| eval HasDelete=if(like(Parameters, "%DeleteMessage%True%"), 1, 0)
| eval HasRedirect=if(like(Parameters, "%RedirectTo%"), 1, 0)
| where HasForward=1 OR HasDelete=1 OR HasRedirect=1
| join type=left RuleUser [
    search index=* (sourcetype="o365:management:activity" OR sourcetype="ms:o365:defender:emailevents")
    | eval RuleUser=lower(coalesce('RecipientEmailAddress', 'MailboxOwnerUPN'))
    | bucket _time span=1h
    | stats count as EmailCount by _time, RuleUser
    | where EmailCount >= 50
]
| table _time, RuleUser, ClientIP, Operation, HasForward, HasDelete, HasRedirect, EmailCount
| sort - _time

Atomic Red Team Tests

Test 1 Simulate Email Bombing via PowerShell SMTP Flood to Test Mailbox
windows

Validates that email bombing detection fires when a high volume of inbound messages arrives at a monitored mailbox within a short window. Uses PowerShell Send-MailMessage to deliver 150 messages in rapid succession to a designated test mailbox. Run only against a test/honeypot email address never used for real communication.

Command

powershell 
$TestRecipient = "[email protected]"
$SmtpServer = "smtp.office365.com"
$SmtpPort = 587
$SenderCred = Get-Credential
$MessageCount = 150
1..$MessageCount | ForEach-Object {
    $Subject = "Test Newsletter Confirmation #$_ - $(Get-Random -Minimum 10000 -Maximum 99999)"
    $Body = "You have been subscribed to mailing list #$_. Click here to confirm."
    Send-MailMessage -To $TestRecipient -From "[email protected]" -Subject $Subject -Body $Body -SmtpServer $SmtpServer -Port $SmtpPort -Credential $SenderCred -UseSsl
    Start-Sleep -Milliseconds 200
}
Write-Host "Sent $MessageCount messages to $TestRecipient"

Cleanup

powershell 
# Remove test emails from mailbox via Exchange Online PowerShell
Connect-ExchangeOnline
Search-Mailbox -Identity "[email protected]" -SearchQuery 'Subject:"Test Newsletter Confirmation"' -DeleteContent -Force
Disconnect-ExchangeOnline

Expected Telemetry

EmailEvents table in Microsoft Defender for Office 365 will show 150 inbound messages to [email protected] within a 10-minute window. OfficeActivity logs will reflect delivery events.

Expected Detection

Alert should fire within 30 minutes with EmailCount >= 100 for the test recipient, BombingIndicator populated, and the query returning the test address as the top recipient by volume.

Test 2 List Subscription Bombing Simulation via Curl (Linux)
linux

Simulates the list-subscription bombing technique by submitting a target test email address to multiple public newsletter signup forms or test endpoints, generating inbound confirmation emails from diverse sender domains. Demonstrates the high sender diversity ratio characteristic of this attack pattern. Run only against a test inbox you control.

Command

bash 
#!/bin/bash
TEST_EMAIL="[email protected]"
LOG_FILE="/tmp/bombing_test_$(date +%Y%m%d_%H%M%S).log"
echo "Starting subscription bombing simulation at $(date)" | tee $LOG_FILE

# Use curl to submit to public test/honeypot newsletter forms
# Replace URLs with actual test newsletter endpoints in your environment
TEST_ENDPOINTS=(
    "https://httpbin.org/post"
    "https://httpbin.org/post"
    "https://httpbin.org/post"
)

for i in $(seq 1 20); do
    for endpoint in "${TEST_ENDPOINTS[@]}"; do
        curl -s -X POST "$endpoint" \
            -d "email=${TEST_EMAIL}&list_id=${RANDOM}&source=atomic_test_${i}" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -o /dev/null -w "Submitted to $endpoint: %{http_code}\n" | tee -a $LOG_FILE
        sleep 0.5
    done
done
echo "Simulation complete. Check $LOG_FILE for results."

Cleanup

bash 
rm -f /tmp/bombing_test_*.log

Expected Telemetry

Network proxy logs will show repeated POST requests to external web endpoints from the test host. Email gateway logs will reflect inbound confirmation messages from diverse sender domains if real newsletter endpoints are used.

Expected Detection

Detection should identify high UniqueDomains and UniqueSenders count relative to EmailCount for the test recipient, triggering the 'List Subscription Bombing' classification in the BombingIndicator field.

Test 3 Validate Vishing Precursor Pattern — Email Bomb + RAT Execution Sequence
windows

Validates the Storm-1811 attack chain detection by simulating the email bombing precursor followed by execution of a remote access tool binary. This tests the correlated hunting query that links email bombing windows to subsequent RAT process creation. Use a sandboxed test environment. The RAT binary used must be a known benign testing version in your security lab.

Command

powershell 
# Phase 1: Generate mock email bombing telemetry in SIEM (requires test SIEM injection capability)
# This creates synthetic EmailEvents data representing a bombing incident
$TestData = @{
    RecipientEmailAddress = "[email protected]"
    EmailCount = 150
    UniqueSenders = 75
    WindowStart = (Get-Date).ToUniversalTime().ToString("o")
}
Write-Host "[Phase 1] Mock bombing telemetry: $($TestData | ConvertTo-Json)"

# Phase 2: Execute benign RAT binary (AnyDesk installer in audit mode) to trigger process telemetry
# Download AnyDesk installer to a temp location (use your organization's approved test binary)
$TempPath = "$env:TEMP\AnyDeskTest_$(Get-Random).exe"
Invoke-WebRequest -Uri "https://download.anydesk.com/AnyDesk.exe" -OutFile $TempPath -UseBasicParsing
Start-Process -FilePath $TempPath -ArgumentList "--install-missing" -PassThru | Out-Null
Write-Host "[Phase 2] Launched RAT binary: $TempPath"
Write-Host "Check Sysmon Event ID 1 for anydesk.exe process creation within 4h of bombing window"

Cleanup

powershell 
# Terminate and remove test RAT binary
Get-Process -Name "AnyDesk" -ErrorAction SilentlyContinue | Stop-Process -Force
Remove-Item "$env:TEMP\AnyDeskTest_*.exe" -Force -ErrorAction SilentlyContinue
Write-Host "Cleanup complete"

Expected Telemetry

Sysmon Event ID 1 will capture anydesk.exe process creation with parent process, command line, and user context. DeviceProcessEvents in Microsoft Defender will record the process. Combined with synthetic email bombing telemetry, the hunting query should correlate the two events.

Expected Detection

The RAT-following-bombing hunting query should match the test user's email address to the anydesk.exe process execution, generating a high-priority hunt hit linking the simulated email bombing window to subsequent remote access tool usage.

Related Detections

Tactic Hub

TA0040Impact

Related Techniques

T1566.004Spearphishing VoiceT1657Financial TheftT1499Endpoint Denial of ServiceT1485Data DestructionT1489Service StopT1496Resource Hijacking

Same Tactic: Impact

Popular Detections