Malicious Emails with QR code Urls

Description

Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303

Query · kql

EmailUrlInfo
| where UrlLocation == "QRCode"
| join kind=inner (
    EmailEvents
    | where isnotempty(ThreatTypes)
    | project NetworkMessageId, ThreatTypes
) on NetworkMessageId
| summarize count() by ThreatTypes
| render piechart
Raw source Malicious Emails with QR code Urls · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 13260191-fb10-4a36-9ca1-2bbc0aaf77d0
name: Malicious Emails with QR code Urls
description: |
  Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.
  Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailUrlInfo
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailUrlInfo
  | where UrlLocation == "QRCode"
  | join kind=inner (
      EmailEvents
      | where isnotempty(ThreatTypes)
      | project NetworkMessageId, ThreatTypes
  ) on NetworkMessageId
  | summarize count() by ThreatTypes
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.