MDO Hunting - Malicious Campaign Overview (EmailClusterId)
MDO 14 Malicious Campaign Overview Email Cluster Id
Query
EmailEvents
| where Timestamp > ago(30d)
| where isnotempty(EmailClusterId)
| where ThreatTypes has_any ("Phish", "Malware")
| summarize
Messages = count(),
Recipients = dcount(RecipientEmailAddress),
Delivered = countif(DeliveryAction == "Delivered"),
Blocked = countif(DeliveryAction == "Blocked"),
Senders = make_set(SenderFromAddress, 15),
Subjects = make_set(Subject, 10),
ThreatMix = make_set(ThreatTypes, 10),
Detections = make_set(DetectionMethods, 10),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by EmailClusterId
| where Recipients >= 5
| extend DeliveredRatio = round(todouble(Delivered) / Messages, 2)
| sort by Recipients descExplanation
This query is designed to analyze and summarize malicious email campaigns over the past 30 days using data from Microsoft Defender's EmailEvents. It focuses on identifying campaigns based on the EmailClusterId, even if detailed campaign information isn't available. The query filters for emails with specific threat types, such as phishing or malware, and aggregates data for each email cluster. It calculates metrics like the number of messages, unique recipients, delivered and blocked emails, and provides details about senders, subjects, threat types, and detection methods. The query also identifies the first and last time each cluster was seen. It prioritizes clusters with at least five recipients and sorts them by the number of recipients, helping to identify significant campaigns that have successfully delivered emails.
Details
David Alonso
Released: July 17, 2026
Tables
Keywords
Operators
Tactics
MITRE Techniques