Malicious email senders

id: 63c799bc-7567-4e4d-97be-e143fcfaa333
name: Malicious email senders
description: |
  This query helps hunting for emails from a sender with at least one email in quarantine
description-detailed: |
  This query helps hunting for emails from a sender with at least one email detected with a threat and sent into quarantine
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SenderWithQuarantine = EmailEvents
  | where LatestDeliveryLocation == "Quarantine"
  | project SenderFromAddress;
  EmailEvents
  | where LatestDeliveryLocation == "Inbox/folder"
  | where SenderFromAddress in (SenderWithQuarantine)
version: 1.0.0