Email malware detection report

id: 23dbd58b-23ce-42ae-b4d1-0dfdd35871ea
name: Email malware detection report
description: |
  This query helps reviewing email malware detection cases
description-detailed: |
  This query helps reviewing email malware detection cases in Defender for Office 365
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - EmailAttachmentInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatNames)
  | join kind=inner EmailAttachmentInfo on NetworkMessageId 
  | extend ThreatFamilyAttachment = strcat(format_datetime(Timestamp,'yyyy-M-dd H:mm:ss'), " /", ThreatNames, " /", FileName, " /", NetworkMessageId)
  | summarize ThreatFamily_wih_Attachment= make_list(ThreatFamilyAttachment) by RecipientEmailAddress
  | extend Case = array_length(ThreatFamily_wih_Attachment)
  | project RecipientEmailAddress, Case, ThreatFamily_wih_Attachment 
  | sort by Case desc
version: 1.0.0