IcedId attachments

Description

Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails. IcedId can lead to ransomware

Query · kql

// Identify a reply or forward via subject line 
let SubjectTerms = pack_array("RE:","FW:","FWD:","AW:","WG:"); 
EmailEvents 
| where Subject has_any(SubjectTerms) 
| where EmailDirection == "Inbound" // Join on those emails by file type (doc or zip>doc) 
| join EmailAttachmentInfo on $left.NetworkMessageId == $right.NetworkMessageId 
| where AttachmentCount == 1 
| where FileType has 'WordStorage' or FileType has 'WordStorage;Zip'
Raw source IcedId attachments · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: bdbbf32f-10a9-492b-a05c-e5987922f8fc
name: IcedId attachments
description: |
  Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
  IcedId can lead to ransomware
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailAttachmentInfo
tactics:
- Ransomware
query: |
  // Identify a reply or forward via subject line 
  let SubjectTerms = pack_array("RE:","FW:","FWD:","AW:","WG:"); 
  EmailEvents 
  | where Subject has_any(SubjectTerms) 
  | where EmailDirection == "Inbound" // Join on those emails by file type (doc or zip>doc) 
  | join EmailAttachmentInfo on $left.NetworkMessageId == $right.NetworkMessageId 
  | where AttachmentCount == 1 
  | where FileType has 'WordStorage' or FileType has 'WordStorage;Zip'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.