Top 100 malicious email senders

id: 12225f50-9d41-4b78-8269-cc127d98654c
name: Top 100 malicious email senders
description: |
  This query helps reviewing top 100 malicious senders
description-detailed: |
  This query helps reviewing top 100 senders sending malicious email in your organization in last 30 days using Defender for Office 365 data
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where ThreatTypes has "Phish" or ThreatTypes has "Malware" 
  | summarize total=count() by SenderMailFromAddress 
  | top 100 by total
version: 1.0.0