RedditPP Mascot

RedditPP

r/sysadmin • … • u/NH_shitbags

Why bother submitting emails to Microsoft for analysis when they get it wrong 50% of the time?

I'm beginning to question whether there's any value in submitting phishing emails to Microsoft for analysis. Occasionally, an obvious phishing/malicious email will somehow make it through defender 365 filters and our plethora of mail flow rules. When this happens, my well trained users report the message, and I further analyze the email to confirm that it is obviously malicious. Once I've confirmed the details, I'll then submit to Microsoft for analysis, but Microsoft has been coming back lately with a verdict of "should not have been blocked". Ummm, wtf. Sometimes they get it right, but it seems like the success rate is about 50%.

(Hey dumbasses, I submitted the email to you because it is obviously malicious, yet you fail to properly analyze)

Does anyone else get any value from submitting messages to Microsoft for analysis? I'm thinking I just won't bother any more, because obviously it isn't going to help if Microsoft is struggling to correctly identify the most obvious phishing emails. Anyone else having this experience with your email submissions? Is MSTIC staffed by monkeys?

— 0