IC Catching Emojis On Email Subjects
Query
// Sergio Albea 17-03-2026 ©️
EmailEvents
| where Timestamp > ago(7d)
| where isnotempty(Subject)
| extend Icons = extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", Subject)
| where isnotempty(Icons)
| join kind=inner UrlClickEvents on NetworkMessageId
| where UserLevelPolicy !has 'Allow'
| where OrgLevelPolicy !has 'Allow'
| extend SenderIP = iff(isnotempty( SenderIPv4),SenderIPv4,SenderIPv6)
| extend geo_ip = tostring(geo_info_from_ip_address(SenderIP).country)
//| where Subject contains "⚠️"
| summarize Distinct_Recipients=dcount(RecipientEmailAddress),make_set(RecipientEmailAddress),Emails=count() by Subject,SenderIP,geo_ip,ActionType, Workload, Url, ThreatTypes, LatestDeliveryLocation
| order by Emails, Distinct_RecipientsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.002 | Phishing: Spearphishing Link |
Author: Sergio Albea (17/03/2026)
[IC] - Catching emojis on email Subjects
| Technique ID | Title |
|---|---|
| T1566 | Phishing |
| Author | Sergio Albea (17/03/2026) |
|---|
Marketing emails use Emojis all the time… but attackers use them too because they catch attention and increase the chance someone clicks:
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
Explanation
This query is designed to detect potentially malicious emails that use emojis in their subject lines to attract attention. Here's a simplified breakdown of what the query does:
-
Time Frame: It looks at email events from the past 7 days.
-
Emoji Detection: It identifies emails that have emojis in their subject lines. Emojis are often used to make emails stand out and increase the likelihood of a recipient clicking on them.
-
URL Click Tracking: The query checks if any URLs in these emails were clicked by joining with URL click events.
-
Exclusion Criteria: It excludes emails from senders who are marked as allowed either at the organizational level or by individual users.
-
Sender Information: It extracts the sender's IP address and determines the country of origin using geo-location data.
-
Summary and Classification: The query summarizes the data by counting the number of emails and distinct recipients. It also identifies whether the emails were delivered to inbox folders.
-
Output: The results are ordered by the number of emails and distinct recipients, providing insights into potentially suspicious email activity.
Overall, this query helps in identifying phishing attempts that use emojis in email subjects to lure recipients into clicking on malicious links.