Email containing malware sent by an internal sender

id: 07c85687-6dee-4266-9345-1e34de85d989
name: Email containing malware sent by an internal sender
description: |
  In this query, we are looking for emails containing malware attachment sent by an internal sender
description-detailed: |
  In this query, we are looking for emails containing malware attachment sent by an internal sender using Defender for Office 365 data
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
   - EmailEvents
tactics:
  - LateralMovement
relevantTechniques:
  - T1534
query: |
  EmailEvents
  | where EmailDirection == "Intra-org" or EmailDirection == "Outbound"
  | where ThreatTypes == "Malware" and SenderFromAddress !startswith "postmaster@" and SenderFromAddress !startswith "microsoftexchange"
  | join (EmailAttachmentInfo | where isnotempty(ThreatTypes)) on NetworkMessageId
version: 1.0.0