Campaign with randomly named attachments

id: 25150085-015a-4673-9b67-bc6ad9475500
name: Campaign with randomly named attachments
description: |
  In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients
description-detailed: |
  In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients using Defender for Office 365 data, typically more than 50, can potentially indicate a QR code phishing campaign.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailAttachmentInfo
  | where Timestamp > ago(7d)
  | where FileType in ("png", "jpg", "jpeg", "gif", "svg")
  | where isnotempty(FileName)
  | extend firstFourFileName = substring(FileName, 0, 4)
  | summarize RecipientsCount = dcount(RecipientEmailAddress), FirstFourFilesCount = dcount(firstFourFileName), suspiciousEmails = make_set(NetworkMessageId, 10) by SenderFromAddress
  | where FirstFourFilesCount >= 10
version: 1.0.0