Top 10% of most attacked users

Description

This query helps reviewing the list of top 10% of most attacked users

Query · kql

let topTargeted = toscalar( EmailEvents 
| where DetectionMethods != "" 
| summarize total=count() by RecipientEmailAddress 
| summarize percentiles(total,90)); 
EmailEvents 
| where DetectionMethods != "" 
| summarize total=count() by RecipientEmailAddress 
| where total >= topTargeted 
| order by total desc
Raw source Top 10% of most attacked users · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: e3b7b5c1-0e50-4dfb-b73a-c226636eaf58
name: Top 10% of most attacked users
description: |
  This query helps reviewing the list of top 10% of most attacked users
description-detailed: |
  This query helps reviewing the list of top 10% of most attacked users using Defender for Office 365 data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let topTargeted = toscalar( EmailEvents 
  | where DetectionMethods != "" 
  | summarize total=count() by RecipientEmailAddress 
  | summarize percentiles(total,90)); 
  EmailEvents 
  | where DetectionMethods != "" 
  | summarize total=count() by RecipientEmailAddress 
  | where total >= topTargeted 
  | order by total desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.