Impersonation Detections by Detection Technology Trend

id: b0fb6dca-bd73-4852-8670-3235e56ffe4d
name: Impersonation Detections by Detection Technology Trend
description: |
  This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time
description-detailed: |
  This query visualises total emails with Phish Business Email Compromise (BEC) Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery = EmailEvents
  | where DetectionMethods has "Phish";
  let bimp=baseQuery
  | project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) 
  | where Phish has 'Impersonation brand' 
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "Impersonation brand";
  let dimp=baseQuery
  | project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) 
  | where Phish has 'Impersonation domain' 
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "Impersonation domain";
  let uimp=baseQuery
  | project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) 
  | where Phish has 'Impersonation user' 
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "Impersonation user";
  let mimp=baseQuery
  | project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) 
  | where Phish has 'Mailbox intelligence impersonation' 
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "Mailbox intelligence impersonation";
  union bimp,dimp,uimp,mimp
  | project Count, Details, Timestamp
  | render timechart
version: 1.0.0