Emails delivered having URLs from QR codes

id: 594fe5a1-53b6-466b-86df-028366c3994e
name: Emails delivered having URLs from QR codes
description: |
  In this query, we hunt for inbound emails delivered having URLs from QR codes
description-detailed: |
  In this query, we hunt for inbound emails delivered having URLs from QR codes using Defender for Office 365 data.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound"
  | where DeliveryAction == "Delivered"
  | join EmailUrlInfo on NetworkMessageId
  | where UrlLocation == "QRCode"
  | project Timestamp, NetworkMessageId, SenderFromAddress, Subject, Url, UrlDomain, UrlLocation,RecipientEmailAddress
version: 1.0.0