Email Top Domains sending Malware

id: c7274e0c-af01-43a3-ad63-6a679191cc7f
name: Email Top Domains sending Malware
description: |
  This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)
description-detailed: |
  This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where ThreatTypes has "Malware" and EmailDirection == "Inbound"
  | summarize count() by SenderFromDomain
  | sort by count_
  | top 15 by count_
  //| render columnchart // Uncomment to display as a column graph
  //| render piechart // Uncomment to display as a piechart
version: 1.0.0