JNLP-File-Attachment

Description

JNLP file extensions are an uncommon file type often used to deliver malware.

Query · kql

EmailAttachmentInfo
| where FileName endswith ".jnlp"
Raw source JNLP-File-Attachment · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b6392f39-a1f4-4ec8-8689-4cb9d28c295a
name: JNLP-File-Attachment
description: |
  JNLP file extensions are an uncommon file type often used to deliver malware.
description-detailed: |
  JNLP file extensions are an uncommon file type often used to deliver malware.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailAttachmentInfo
tactics:
- InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailAttachmentInfo
  | where FileName endswith ".jnlp"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.