Emails with QR codes and suspicious keywords in subject

id: 706b711a-7622-40f1-9ebb-331d1a0ff697
name: Emails with QR codes and suspicious keywords in subject
description: |
  In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject
description-detailed: |
  In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject using Defender for Office 365 data.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SubjectKeywords = ()
  {pack_array("authorize", "authenticate", "account", "confirmation", "QR", "login", "password",  "payment", "urgent", "verify");};
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound"
  | where DeliveryAction == "Delivered"
  | where Subject has_any (SubjectKeywords)
  | join EmailUrlInfo on NetworkMessageId
  | where UrlLocation == "QRCode"
version: 1.0.0