KQL Search

Query Details

HomeAI ToolsDevice Query

DCA Find User Submitted Phishing Spam

Query

//Find emails that have been reported by your users as spam/phishing that have been rescanned and found to be genuine spam or phishing

//Data connector required for this query - M365 Defender - CloudAppEvents

//Microsoft Sentinel query
CloudAppEvents
| where ActionType == "UserSubmission"
| extend UserId = tostring(RawEventData.UserId)
| extend RescanVerdict = tostring(parse_json(tostring(RawEventData.RescanResult)).RescanVerdict)
| extend RescanTimeTimestamp = tostring(parse_json(tostring(RawEventData.RescanResult)).Timestamp)
| extend Subject = tostring(RawEventData.Subject)
| extend P1Sender = tostring(RawEventData.P1Sender)
| extend P2Sender = tostring(RawEventData.P2Sender)
| where RescanVerdict != "NotSpam"
| project
    TimeGenerated,
    UserId,
    P1Sender,
    P2Sender,
    Subject,
    RescanVerdict,
    RescanTimeTimestamp

//Data connector required for this query - Advanced Hunting license

//Advanced Hunting query
CloudAppEvents
| where ActionType == "UserSubmission"
| extend UserId = tostring(RawEventData.UserId)
| extend RescanVerdict = tostring(parse_json(tostring(RawEventData.RescanResult)).RescanVerdict)
| extend RescanTimeTimestamp = tostring(parse_json(tostring(RawEventData.RescanResult)).Timestamp)
| extend Subject = tostring(RawEventData.Subject)
| extend P1Sender = tostring(RawEventData.P1Sender)
| extend P2Sender = tostring(RawEventData.P2Sender)
| where RescanVerdict != "NotSpam"
| project
    Timestamp,
    UserId,
    P1Sender,
    P2Sender,
    Subject,
    RescanVerdict,
    RescanTimeTimestamp

Explanation

This query is used to find emails that have been reported by users as spam or phishing, and have been rescanned and confirmed to be genuine spam or phishing. It uses the M365 Defender - CloudAppEvents data connector in Microsoft Sentinel to retrieve the necessary data. The query filters the CloudAppEvents data based on the ActionType being "UserSubmission" and the RescanVerdict not being "NotSpam". It then extracts relevant fields such as TimeGenerated, UserId, P1Sender, P2Sender, Subject, RescanVerdict, and RescanTimeTimestamp for further analysis. Additionally, an Advanced Hunting license is required for this query.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 20, 2022

Tables

CloudAppEvents

Keywords

CloudAppEvents,ActionType,UserSubmission,UserId,RescanVerdict,RawEventData,RescanResult,Timestamp,Subject,P1Sender,P2Sender,TimeGenerated

Operators

whereextendtostringparse_json!=project

Actions