Hunting for user signals-clusters

id: 8c852f12-499f-499b-afc1-25c50aa9b462
name: Hunting for user signals-clusters
description: |
  In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign.
description-detailed: |
  In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign. We use Emails with similar content are clustered by MDO together and the cluster ID is populated in the EmailClusterId field in EmailEvents table using Defender for Office 365 data.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let suspiciousClusters = EmailEvents
  | where Timestamp > ago(7d)
  | where EmailDirection == "Inbound"
  | where NetworkMessageId in ("5ff15b1f-d731-4625-4c1c-08dc8615943f","00ff0916-1263-428c-a558-08dc86a6d3cd") //<List of suspicious Network Message Ids from Alerts>
  | distinct EmailClusterId;
  EmailEvents
  | where Timestamp > ago(7d)
  | where EmailDirection == "Inbound"
  | where EmailClusterId in (suspiciousClusters)
  | summarize make_set(Subject), make_set(SenderFromDomain), dcount(RecipientObjectId),dcount(SenderDisplayName) by EmailClusterId
version: 1.0.0