Detect Microsoft Shared File Messages Via Internet Message Id Odspnotify Value
Query
//Sergio Albea 19-04-2026 ©️
EmailEvents
| where InternetMessageId contains "odspnotify"
| where SenderFromDomain !in ("sharepointonline.com","trustedomain2.ch")
| extend IMF = trim(@"[<>]", tostring(InternetMessageId))
| extend IMF_Left = tostring(split(IMF, "@")[0])
| extend IMF_Parts = split(IMF_Left, ";")
| extend MessageTypeFull = tostring(IMF_Parts[0])
| extend MessageTypeName = extract(@"^(.*)-[0-9a-fA-F-]{36}$", 1, MessageTypeFull)
| extend MessageTypeGuid = extract(@"([0-9a-fA-F-]{36})$", 1, MessageTypeFull)
| where MessageTypeName has 'Share'
| extend MessageTypeAfterDash = tostring(split(MessageTypeFull, "-")[1])| join kind=inner EmailUrlInfo on NetworkMessageId
| summarize Urls=make_set(Url) by InternetMessageId,Subject, SenderDisplayName, SenderMailFromAddress, SenderFromDomain, SenderIP=iff(isnotempty(SenderIPv4),SenderIPv4,SenderIPv6), ThreatTypes,MessageTypeName,RecipientDomain, RecipientEmailAddress, ReportIdAbout this query
Explanation
This query is designed to detect potentially malicious emails that use Microsoft services like SharePoint to share links, which could be part of a phishing campaign. Here's a simple breakdown of what the query does:
-
Data Source: It starts by looking at email events, specifically focusing on emails where the
InternetMessageIdcontains the term "odspnotify". This term is associated with notifications from Microsoft services like SharePoint. -
Filtering: The query excludes emails from trusted domains (e.g., "sharepointonline.com" and "trustedomain2.ch") to focus on potentially suspicious sources.
-
Processing the Message ID:
- It extracts and processes parts of the
InternetMessageIdto identify the type of message. - Specifically, it looks for messages where the type indicates a "Share" action, suggesting that a link was shared.
- It extracts and processes parts of the
-
Joining Data: The query joins this information with another dataset (
EmailUrlInfo) to gather more details about the URLs included in the emails. -
Summarizing Results: Finally, it summarizes the findings by listing the URLs, email subject, sender details, threat types, and recipient information. This helps identify emails that might be part of a phishing attempt using shared links from unexpected domains.
In essence, this query helps detect phishing attempts where malicious actors use Microsoft services to share links, by focusing on the message type and excluding known safe domains.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques