Email containing malware accessed on a unmanaged device

id: 439f817c-845c-4dda-a8d9-5c1f6831cee9
name: Email containing malware accessed on a unmanaged device
description: |
  In this query, we are looking for emails containing malware accessed on a unmanaged device
description-detailed: |
  In this query, we are looking for emails containing malware accessed on a unmanaged device by MDE. The query using multiple data sources across Defender XDR including Defender for Office 365
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
   - EmailPostDeliveryEvents
   - CloudAppEvents
   - EntraIdSignInEvents
tactics:
  - Execution
relevantTechniques:
  - T1204
query: |
  EmailPostDeliveryEvents
  | where ActionType == "Malware ZAP"
  | project NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,ZAPReportId=ReportId,ZAPTimestamp=Timestamp
  | join (CloudAppEvents | where ActionType == "MailItemsAccessed"
  | extend RawEvent=parse_json(RawEventData)
  | mv-expand RawEvent.Folders
  | mv-expand RawEvent_Folders.FolderItems
  | project SessionId=tostring(RawEvent.SessionId),InternetMessageId=tostring(parse_json(RawEvent_Folders_FolderItems).InternetMessageId),ActionTimestamp=Timestamp,ActionReportId=ReportId
  ) on InternetMessageId
  | where isnotempty(SessionId)
  | join (EntraIdSignInEvents | where isempty(DeviceName) | distinct AccountUpn,SessionId) on SessionId
  | project AccountUpn,NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,SessionId,ReportId=ActionReportId,Timestamp=ActionTimestamp
version: 1.0.0