ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • Suspicious Email • Social Engineering • Business Awards • Defender XDR • EmailEvents • EmailUrlInfo • KQL

The Award I Didn't Enter Somehow Won Me First Prize

The email began with one of the most dangerous words in the inbox.

Congratulations.

Apparently, GEMXIT had been selected and approved for a business award. There would be recognition, a certificate, a badge and a directory listing.

This was excellent news.

There was only one small problem.

I couldn't remember entering anything.

Discuss email security Back to investigations
Agent Foskett investigating an unexpected congratulations business award email
The Congratulations Test

An unexpected compliment can lower the guard before the real request appears.

Verify the sender and authentication
Inspect every embedded domain and call to action
Separate technical legitimacy from commercial value

The email arrived carrying its own applause

The message said the business had been selected and approved, praised its vision and leadership, offered official recognition and then introduced registration, membership options and administrative fees. None of those phrases proves malicious intent. Together, however, they create a very useful investigation exercise.
Congratulations came firstThe message began by giving the recipient something emotionally valuable: recognition.
Authority followedWords such as selected, approved, verified, official and standards gave the message an institutional tone.
Then came the actionThe recipient was invited to register and consider membership benefits and associated fees. That is where curiosity becomes a security decision.

First question: have we seen this sender before?

In Microsoft Defender XDR, start with EmailEvents. Search for the sender domain, review delivery, authentication and threat verdicts, and establish whether this is a one-off message or part of a wider campaign.
business-award-email.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
EmailEvents
| where Timestamp > ago(30d)
| where SenderFromDomain =~ "wcbrb.com"
   or Subject has_any ("Congratulations", "Best Businesses", "Award")
| project Timestamp,
          SenderFromAddress,
          SenderFromDomain,
          RecipientEmailAddress,
          Subject,
          DeliveryAction,
          DeliveryLocation,
          ThreatTypes,
          AuthenticationDetails,
          NetworkMessageId
| order by Timestamp desc

Authentication answers one question — not all of them

SPF, DKIM, DMARC and composite authentication help determine whether the message is technically consistent with the domain claiming to send it. Passing authentication does not tell you whether the offer is valuable, wanted or trustworthy enough to act on.
authentication-review.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
EmailEvents
| where Timestamp > ago(30d)
| where SenderFromDomain =~ "wcbrb.com"
| extend Auth = parse_json(AuthenticationDetails)
| project Timestamp,
          SenderFromAddress,
          SenderFromDomain,
          Subject,
          AuthenticationDetails,
          ThreatTypes,
          DetectionMethods,
          DeliveryAction,
          DeliveryLocation,
          NetworkMessageId
| order by Timestamp desc

Now inspect what the email wants you to click

EmailUrlInfo lets the investigator pivot from the message to the URLs it contained. That matters here because the email included both organisational links and a separate registration form. A legitimate-looking sender does not automatically make every destination equally trustworthy.
extract-email-urls.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
  18. 18
  19. 19
EmailEvents
| where Timestamp > ago(30d)
| where SenderFromDomain =~ "wcbrb.com"
| project Timestamp, NetworkMessageId, SenderFromAddress,
          RecipientEmailAddress, Subject
| join kind=inner (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| project Timestamp,
          SenderFromAddress,
          RecipientEmailAddress,
          Subject,
          UrlDomain,
          Url,
          UrlLocation
| order by Timestamp desc

Hunt for the pattern, not just this organisation

The most reusable detection is behavioural. Search for unsolicited recognition language across the tenant. The result set may contain genuine awards, newsletters and marketing, so this is a hunting query for analyst review rather than a declaration that every match is phishing.
recognition-language-hunt.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
  18. 18
  19. 19
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
| where Subject has_any (
    "congratulations",
    "selected and approved",
    "business award",
    "best businesses",
    "recognition",
    "verification certificate"
)
| summarize Messages = count(),
            Recipients = dcount(RecipientEmailAddress),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
    by SenderFromDomain, SenderFromAddress, Subject
| order by Messages desc

The psychology was more interesting than the payload

This is where Agent Foskett stopped looking only for malware. Social engineering works by influencing judgement. Praise, authority, exclusivity and urgency can all encourage action before verification.
Flattery changes the starting pointInstead of asking “is this genuine?”, the recipient may start by thinking “what did we win?”
Prestige can borrow trustCertificates, badges, committees, standards and directories can sound authoritative even when the recipient has never heard of the organisation.
The commercial ask arrives laterOnce the recipient accepts the premise that the recognition matters, registration or payment can feel like completing the award rather than evaluating a purchase.

So was it phishing?

That question is deliberately harder than it looks. An email can be unsolicited and commercially motivated without being credential phishing or malware. Analysts should classify what the evidence supports instead of forcing every unwanted message into the word “scam”.
Technical legitimacyDoes the sender authenticate correctly? Do the visible sender, return path and domains make sense? Where are the URLs actually going?
Security classificationIs there credential harvesting, malware, impersonation, spoofing, malicious redirection or another demonstrable threat?
Commercial judgementEven if the message is technically legitimate, is the recognition meaningful enough that the organisation actually wants to register or pay for it?

Agent Foskett's investigation mindset

The word “Congratulations” is not an indicator of compromise. But it is an excellent reason to ask: congratulations for what, exactly?
Do not investigate the complimentInvestigate the evidence: sender, authentication, domains, URLs, reputation, requested action and business context.
Do not confuse delivery with endorsementAn email reaching the inbox does not mean Microsoft, your organisation or your security team has vouched for the proposition inside it.
Do not overstate the findingIf the evidence supports unsolicited marketing, say unsolicited marketing. If it supports phishing, say phishing. Precision matters.

Investigation findings

The interesting finding was not a dramatic malware payload. It was the sequence of persuasion: recognition first, authority second, action third. That pattern is worth teaching because attackers and legitimate marketers alike understand that people act differently after being told they have won.
No award entry was required to create interestThe unexpected nature of the recognition was itself the clue that justified verification before engagement.
The links deserved independent reviewRegistration links, forms and destination domains should be investigated independently of the friendly wording surrounding them.
Security and business value are separate verdictsA message does not need to be malicious for the safest business decision to be “no thanks”.

Related Agent Foskett investigations

Continue with email authentication, suspicious links and practical Microsoft Defender investigations.
EmailEvents KQL GuideLearn how to investigate Microsoft 365 email delivery, sender details, authentication and threat verdicts with KQL.
SPF Was Valid — But for the Wrong DomainSee why an authentication pass does not automatically prove the sender you think it proves.
Agent Foskett AcademyBuild practical Microsoft security investigation and KQL skills through structured lessons.
Congratulations! You have won today's most important security prize.
The right to verify the email before clicking anything.
Visit the Agent Foskett Academy

Final thought

Not every suspicious-looking email is phishing. Not every unsolicited offer is a scam. But every unexpected message asking you to trust, click, register or pay deserves evidence before action.
Enjoy the complimentThere is nothing wrong with smiling when an email says you are brilliant.
Then investigate itCheck the sender, authentication, links, requested action and independent context before engaging.
Congratulations for what, exactly?Sometimes the simplest question in the investigation is the one that changes the entire story.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The Award I Didn't Enter Somehow Won Me First Prize

This Agent Foskett investigation explores an unexpected business award email and demonstrates how analysts can distinguish technical email legitimacy from phishing, spam, unsolicited commercial messaging and commercial value.

Microsoft Defender XDR EmailEvents And EmailUrlInfo Investigation

The investigation uses Microsoft Defender XDR advanced hunting with EmailEvents and EmailUrlInfo to review sender domains, email authentication, delivery, threat verdicts and URLs embedded in suspicious or unsolicited email.

Social Engineering, Business Award Emails And KQL

GEMXIT helps organisations investigate suspicious Microsoft 365 email, social engineering, sender authentication and embedded URLs using practical KQL and evidence-driven Microsoft Defender XDR workflows.