Top Users receiving Malware

id: 1c423f0d-57d6-41dc-869f-79899a2dae77
name: Top Users receiving Malware
description: |
  This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)
description-detailed: |
  This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where ThreatTypes has "Malware" and EmailDirection == "Inbound"
  | summarize count() by RecipientEmailAddress
  | sort by count_
  | top 15 by count_
  //| render columnchart // Uncomment to display as a column graph
  //| render piechart // Uncomment to display as a piechart
version: 1.0.0