Top external malicious senders

id: 9d6c8c17-06b0-4044-b18e-35eb3dfc5cf2
name: Top external malicious senders
description: |
  This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
description-detailed: |
  This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days using Defender for Office 365 data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d) 
  | where EmailDirection == "Inbound" 
  | summarize count() by SenderFromAddress 
  | sort by count_
version: 1.0.0