Hunt for malicious attachments using external IOC source

id: 0da830c3-5d0e-4b98-bfa1-d5131a8d0ebe
name: Hunt for malicious attachments using external IOC source
description: |
  This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source
description-detailed: |
  This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source using Defender for Office 365 and Advance hunting in Microsoft Defender XDR
  Reference - https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-best-practices#ingest-data-from-external-sources
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailAttachmentInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let abuse_sha256 = (externaldata(sha256_hash: string)
  [@"https://bazaar.abuse.ch/export/txt/sha256/recent/"]
  with (format="txt"))
  | where sha256_hash !startswith "#"
  | project sha256_hash;
  abuse_sha256
  | join (EmailAttachmentInfo
  | where Timestamp > ago(1d)
  ) on $left.sha256_hash == $right.SHA256
  | project Timestamp,SenderFromAddress,RecipientEmailAddress,FileName,FileType,SHA256,ThreatTypes,DetectionMethods,NetworkMessageId,ReportId
version: 1.0.0