IcedId email delivery

Description

Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware

Query · kql

EmailUrlInfo 
| where Url matches regex @"\bsites\.google\.com\/view\/(?:id)?\d{9,}\b" 
| join EmailEvents on NetworkMessageId // Note: Replace the following subject lines with the one generated by your website's Contact submission form if no results return initially 
| where Subject has_any('Contact Us', 'New Submission', 'Contact Form', 'Form submission')
Raw source IcedId email delivery · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1d8393fe-e363-40c1-8efb-66cf1ad68a05
name: IcedId email delivery
description: |
  Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
  - EmailEvents
tactics:
- Initial access
- Ransomware
query: |
  EmailUrlInfo 
  | where Url matches regex @"\bsites\.google\.com\/view\/(?:id)?\d{9,}\b" 
  | join EmailEvents on NetworkMessageId // Note: Replace the following subject lines with the one generated by your website's Contact submission form if no results return initially 
  | where Subject has_any('Contact Us', 'New Submission', 'Contact Form', 'Form submission')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.