Detecting Emails Sent By Countries Using Non Oficial Languages
Query
let CountryLanguageMap = externaldata(ISO2:string,Country:string,ExpectedLanguages:string)
[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/refs/heads/main/Security-Lists/country_Language.csv"] with (format = "csv",ignoreFirstRecord = true)
| extend ExpectedLanguagesArray = split(tolower(ExpectedLanguages), ";");
EmailEvents
| extend SenderIP = iff(isnotempty(SenderIPv4),SenderIPv4,SenderIPv6)
| where isnotempty(SenderIP) and isnotempty(EmailLanguage)
| extend GeoInfo = geo_info_from_ip_address(SenderIP)
| extend Country = tostring(GeoInfo.country)
| extend DetectedLanguage = tolower(substring(tostring(EmailLanguage), 0, 2)) | lookup kind=leftouter CountryLanguageMap on Country
| where isnotempty(ExpectedLanguages) and isnotempty(DetectedLanguage) and DetectedLanguage !in ("un", "xx") and array_index_of( ExpectedLanguagesArray, DetectedLanguage) == -1
| summarize
EmailCount = count(),FirstSeen = min(Timestamp),LastSeen = max(Timestamp),Subjects = make_set(Subject, 10),ThreatTypes = make_set(ThreatTypes, 10),SenderDomains = make_set(SenderFromDomain, 10)
by SenderIP,Country,DetectedLanguage,EmailLanguage
| where EmailCount < 10 and Country !in ("United States") and SenderDomains !in ("Domain1","Domain2")About this query
Explanation
This KQL query is designed to identify potentially suspicious emails by detecting cases where the language of an email does not match the expected language(s) of the sender's country. Here's a simplified breakdown of what the query does:
-
Country-Language Mapping: It uses an external CSV file to map countries to their expected languages. This file is fetched from a GitHub repository.
-
Email Data Processing: The query processes email events to extract the sender's IP address and the language of the email. It then uses the sender's IP to determine the country of origin.
-
Language Mismatch Detection: For each email, it checks if the detected language of the email matches any of the expected languages for the sender's country. If there's a mismatch, it flags the email.
-
Filtering:
- It only considers emails where the detected language is not "un" (unknown) or "xx" (undefined).
- It summarizes the results by counting emails, noting the first and last time they were seen, and listing unique subjects, threat types, and sender domains.
- It applies additional filters to exclude emails from certain countries (like the United States) and trusted domains, and only considers cases where fewer than 10 emails were observed.
-
Purpose: The query is not a definitive detection tool but serves as a hunting signal. It helps identify emails that might warrant further investigation, especially when combined with other indicators of phishing or malicious activity.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques