Query

let MaliciousEmailCluseriId = "3163234347533"; // Input the EmailClusterId here
EmailEvents
| where EmailClusterId == MaliciousEmailCluseriId

About this query

Find Related Emails

Query Information

Description

The EmailClusterId which can be assigned to a mail is the identifier for the group of similar emails clustered based on heuristic analysis of their contents. Therefore this identifier can be leveraged to find related mails. This is not a hash value of the mail. Once you have identified a suspicious mail, you can run the query below to determine if there are related mails send to your users. This can for example be from a different sender or the content of the mail has changed from Hello Bob to Hello Alice but the rest of the contents has stayed the same.

References

https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-emailevents-table?view=o365-worldwide

Defender XDR

Sentinel

let MaliciousEmailCluseriId = "3163234347533"; // Input the EmailClusterId here
EmailEvents
| where EmailClusterId == MaliciousEmailCluseriId

Explanation

This query is designed to help you find emails that are related to a suspicious email by using a specific identifier called the "EmailClusterId." This identifier groups similar emails based on their content, even if minor details like the recipient's name have changed. By inputting the EmailClusterId of a suspicious email, the query searches through email events to find other emails with the same cluster ID, indicating they are related. This can help identify potentially malicious emails sent to users, even if they come from different senders or have slight content variations. The query is applicable in both Defender XDR and Sentinel environments.

KQL Search