files-from-malicious-sender

id: 43625c12-5712-44df-8741-c334746aeccc
name: files-from-malicious-sender
description: |
  This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailAttachmentInfo
  - DeviceFileEvents
tactics:
- Initial access
query: |
  //Get prevalence of files sent by a malicious sender in your organization
  EmailAttachmentInfo
  | where SenderFromAddress =~ "MaliciousSender@example.com"
  | where isnotempty(SHA256)
  | join (
  DeviceFileEvents
  | project FileName, SHA256
  ) on SHA256