Defender for Office - Email File Attachment File Extensions
MDO Email Attachment File Extensions
Query
EmailEvents
| join EmailAttachmentInfo
on $left. NetworkMessageId == $right.NetworkMessageId
| extend DotCount = countof(FileName,".")
| extend FileExtension = strcat(".", split(FileName,".",DotCount)[0])
| where DeliveryAction != 'Delivered'
| where DotCount > 0
| project FileName, FileExtension, FileType, DotCount, EmailDirection, ThreatTypes
| summarize Out = countif(EmailDirection == 'Outbound'),In = countif(EmailDirection == 'Inbound'), Intra = countif(EmailDirection == 'Intra-org'), Unknown = countif(EmailDirection == 'Unknown') by FileExtension
| sort by FileExtensionAbout this query
Explanation
The query retrieves information about email attachment file extensions, specifically focusing on legacy office file formats. It counts the number of inbound, outbound, intra-org, and unknown email directions for each file extension. It also provides details such as the timestamp, file name, file type, dot count, email direction, threat types, and network message ID for specific file extensions or inbound emails. Additionally, it includes queries for analyzing legacy files on SharePoint and OneDrive, as well as device file creation events for legacy office file formats.
Details
Alex Verboon
Released: June 4, 2023
Tables
EmailEvents
EmailAttachmentInfo
EmailPostDeliveryEvents
CloudAppEvents
DeviceFileEvents
Keywords
DevicesIntuneUser
Operators
joinonextendcountofstrcatsplitwhereprojectsummarizecountifbysortletindynamicrenderparse_path