Quarantine Malware Reason

id: 2d730733-6a56-470f-aa2c-f583611ffb50
name: Quarantine Malware Reason
description: |
  This query visualises the total amount of malware emails that are quarantined, summarized by the detection method
description-detailed: |
  This query visualises the total amount of malware emails that are quarantined, summarized by the detection method that caught them, using Advanced hunting in Microsoft Defender XDR. It completes the set alongside the equivalent phish and spam quarantine reason queries. Knowing which detection technology is filling quarantine with malware shows where protection is actually working, and a sudden shift in the mix is worth investigating: it usually means either a change in the attacks arriving or a change in which layer is catching them.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and DetectionMethods has 'Malware' and DeliveryLocation == "Quarantine"
  | mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)
  | where isnotempty(Malware)
  | summarize count() by Malware
  | sort by count_ desc
  | render piechart
version: 1.0.0