A practical Microsoft Defender XDR and KQL approach for identifying high-value users, hunting executive impersonation, and prioritizing threats that reach VIP mailboxes.

The Challenge: Do You Know Who Your VIP Users Are?

Executives and other high-value users are attractive targets because their identities carry authority, access to sensitive information, and influence over financial and business processes. They are frequently relevant to phishing, executive impersonation, credential theft, and Business Email Compromise (BEC).

For a SOC, the first challenge is surprisingly basic: who exactly are the organization’s VIP users? Static lists can become outdated as employees join, leave, change roles, or take on responsibilities that increase their value to an attacker. A useful VIP definition may also extend beyond the C-suite to finance approvers, executive assistants, legal leadership, and privileged administrators.

The SHQ Adversary Labs Approach

SHQ Adversary Labs has developed a threat-hunting use case that connects VIP identification with threat investigation. Using identity and security telemetry in Microsoft Defender XDR, analysts can dynamically identify potential VIP users and then use that population as context for subsequent hunts.

From Identification to Monitoring

Who Is Pretending to Be Our VIPs?

KQL-based hunting can correlate inbound email telemetry with the VIP population to identify external senders using VIP display names or usernames, spoofing and impersonation signals, and the same impersonated identity targeting multiple employees.

Who Is Targeting Our VIPs?

The same VIP population can be used to identify phishing directed at high-value users, suspicious messages that were successfully delivered, first-contact communications with URLs or attachments, repeated targeting, and campaigns affecting multiple VIPs

Reference Hunting Queries

These examples are starting points for hunting and tuning. They are not intended to be deployed unchanged as production detections.

Identify Potential VIP Users

let ExecutiveUsers = materialize(
    IdentityInfo
    | where TimeGenerated > ago(3d)
    | where IsAccountEnabled == true
    | where UserType == "Member"
    | where JobTitle has_any (
        "Chief","CEO","CFO","CTO","CISO",
        "President","Director","VP","Vice President"
    )
    | summarize arg_max(TimeGenerated, *) by AccountObjectId
    | project VIPName = AccountDisplayName,
              VIPUPN = tolower(AccountUPN),
              VIPAccountName = tolower(AccountName), JobTitle
);

Hunt for VIP Display-Name Impersonation

Look for inbound messages where an external sender uses the same display name as a known VIP.

EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection =~ "Inbound"
| extend SenderAddress = tolower(SenderFromAddress),
         SenderName = tolower(SenderDisplayName)
| join kind=inner (
    ExecutiveUsers | extend VIPNameNormalized = tolower(VIPName)
) on $left.SenderName == $right.VIPNameNormalized
| where SenderAddress != VIPUPN
| project TimeGenerated, VIPName, JobTitle, SenderDisplayName,
          SenderFromAddress, SenderFromDomain, RecipientEmailAddress,
          Subject, AuthenticationDetails, ThreatTypes, DeliveryAction, NetworkMessageId
| order by TimeGenerated desc

Identify Phishing Emails Targeting VIP Users

Focus phishing telemetry on the users whose compromise may create disproportionate business risk.

EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection =~ "Inbound"
| extend Recipient = tolower(RecipientEmailAddress)
| join kind=inner ExecutiveUsers on $left.Recipient == $right.VIPUPN
| where ThreatTypes has "Phish"
| project TimeGenerated, VIPName, VIPUPN, JobTitle, SenderFromAddress,
          SenderFromDomain, Subject, AuthenticationDetails, ThreatTypes,
          DetectionMethods, IsFirstContact, UrlCount, AttachmentCount,
          DeliveryAction, DeliveryLocation, NetworkMessageId
| order by TimeGenerated desc

Prioritize Threats Successfully Delivered to VIPs

Surface phishing or malware that reached a VIP mailbox and should receive deeper investigation.

EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection =~ "Inbound"
| extend Recipient = tolower(RecipientEmailAddress)
| join kind=inner ExecutiveUsers on $left.Recipient == $right.VIPUPN
| where ThreatTypes has_any ("Phish", "Malware")
| where DeliveryAction =~ "Delivered"
| project TimeGenerated, VIPName, VIPUPN, JobTitle, SenderFromAddress,
          SenderFromDomain, Subject, ThreatTypes, DetectionMethods,
          UrlCount, AttachmentCount, IsFirstContact, DeliveryLocation, NetworkMessageId
| order by TimeGenerated desc

Why KQL Makes the Difference

The value is not simply another phishing query. KQL allows the SOC to combine identity context with threat telemetry and ask higher-value questions: Is someone impersonating an executive? Which VIPs are being targeted? Did suspicious content reach the mailbox? Is the same infrastructure targeting multiple users?

From Hunting to Detection

Identify VIPs  →  Hunt for impersonation and targeting  →  Establish normal behaviour  →  Tune the logic  →  Operationalize valuable patterns as detections

The SHQ Adversary Labs queries are designed as hunting starting points rather than one-size-fits-all rules. Each organization has different executives, business relationships, communication patterns, and telemetry. Analysts should validate and tune the logic before operationalizing it.

Protecting Identity, Authority and Trust

VIP threat hunting is ultimately about more than protecting executive mailboxes. Attackers target high-value users because of what their identities represent: access, authority and trust. The methodology helps SOC teams answer two practical questions: who is pretending to be our high-value users, and who is trying to compromise them?