id: a1664330-810a-473b-b354-acbaa751a294
name: Top targeted users
description: |
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days
description-detailed: |
This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days using Defender for Office 365 data.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
EmailEvents
| where Timestamp > ago(30d)
| where ThreatTypes has "Malware" or ThreatTypes has "Phish"
| summarize count() by RecipientEmailAddress
| sort by count_
version: 1.0.0