Emails with QR codes from non-prevalent sender

Description

In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders

Query · kql

let senderprevalence =
EmailEvents
| where Timestamp between (ago(7d)..(now()-24h))
| where isnotempty(SenderFromAddress)
| summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress
| where TotalEmailCount > 1;
let prevalent_Sender = senderprevalence
| where isnotempty (SenderFromAddress)
| distinct SenderFromAddress;
let QR_from_non_prevalent =
EmailEvents
| where EmailDirection == "Inbound"
| where Timestamp > ago(1d)
| where SenderFromAddress !in (prevalent_Sender)
| join EmailUrlInfo on NetworkMessageId
| where UrlLocation == "QRCode"
| distinct SenderFromAddress,Url,NetworkMessageId;
QR_from_non_prevalent
Raw source Emails with QR codes from non-prevalent sender · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f708c866-073a-4107-a60b-ba6f86e54caa
name: Emails with QR codes from non-prevalent sender
description: |
  In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders
description-detailed: |
  In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders using Defender for Office 365 data.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let senderprevalence =
  EmailEvents
  | where Timestamp between (ago(7d)..(now()-24h))
  | where isnotempty(SenderFromAddress)
  | summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress
  | where TotalEmailCount > 1;
  let prevalent_Sender = senderprevalence
  | where isnotempty (SenderFromAddress)
  | distinct SenderFromAddress;
  let QR_from_non_prevalent =
  EmailEvents
  | where EmailDirection == "Inbound"
  | where Timestamp > ago(1d)
  | where SenderFromAddress !in (prevalent_Sender)
  | join EmailUrlInfo on NetworkMessageId
  | where UrlLocation == "QRCode"
  | distinct SenderFromAddress,Url,NetworkMessageId;
  QR_from_non_prevalent
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.