KQL Search

This KQL query is designed to identify potential phishing campaigns that use Microsoft Forms. Here's a simple summary of what the query does:

1. Data Source: It starts by looking at the EmailUrlInfo table.
2. Time Filter: It filters the data to include only records from the past hour.
3. Join Operation: It joins this data with the EmailEvents table using the NetworkMessageId field to combine related information from both tables.
4. Extract Authentication Details: It extracts and parses the AuthenticationDetails field into a JSON object for easier access.
5. Inbound Emails: It filters the results to include only inbound emails.
6. Target Domain: It further filters the results to include only emails that contain URLs pointing to the domain forms.microsoft.com.
7. Authentication Failures: Finally, it filters the results to include only emails where all three authentication checks (SPF, DKIM, and DMARC) have failed.

In essence, this query helps identify potentially malicious emails that are using Microsoft Forms and have failed all standard email authentication checks, indicating they might be part of a phishing campaign.