High Confidence Phish Released

Description

This query shows information about high confidence phish email that has been released from the Quarantine.

Query · kql

CloudAppEvents 
| where ActionType == "QuarantineReleaseMessage"
| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo
| join kind=inner (
  EmailEvents
  | where todynamic(ConfidenceLevel).Phish == "High"
  | project-rename EmailTime = Timestamp
  ) on NetworkMessageId
| project-away NetworkMessageId1
| order by ReleaseTime asc
Raw source High Confidence Phish Released · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9e8faa62-7222-48a5-a78f-ef2d22f866dc
name: High Confidence Phish Released
description: |
  This query shows information about high confidence phish email that has been released from the Quarantine.
description-detailed: |
  This query shows information about high confidence phish email that has been released from the Quarantine in Defender for Office 365. The details include the time each email was released and who it was released by.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType == "QuarantineReleaseMessage"
  | project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo
  | join kind=inner (
    EmailEvents
    | where todynamic(ConfidenceLevel).Phish == "High"
    | project-rename EmailTime = Timestamp
    ) on NetworkMessageId
  | project-away NetworkMessageId1
  | order by ReleaseTime asc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.