File Malware by Top Malware Families (Safe Attachments)

id: afd90d9e-f8f5-41c7-823a-616907392503
name: File Malware by Top Malware Families (Safe Attachments)
description: |
  This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
description-detailed: |
  This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == 'FileMalwareDetected' and UserAgent =~ 'MS Scanner ATP'
  | project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo
  | summarize count() by tostring(RawinfoVirusInfo) | sort by count_
  | render piechart
  // | render columnchart // Uncomment to change the graph type
version: 1.0.0