Temporary Email Addresses
Query
let TempEmailAddresses = externaldata (mail: string) [@'https://raw.githubusercontent.com/jkerai1/TLD-TABL-Block/refs/heads/main/tempmail-abused%20emaildomains.txt'] with (format=csv, ignoreFirstRecord=False);
EmailEvents
| where TimeGenerated > ago(90d)
| where SenderFromDomain has_any (TempEmailAddresses) or RecipientEmailAddress has_any(TempEmailAddresses)
//| join kind=leftouter EmailUrlInfo on NetworkMessageId
//| summarize make_list(Url) by NetworkMessageId,SenderFromAddress, RecipientEmailAddress, Subject, AttachmentCount, UrlCount
// Visit https://github.com/jkerai1/TLD-TABL-Block for Block ScriptExplanation
This KQL (Kusto Query Language) query is designed to identify email events involving temporary or potentially abused email domains. Here's a simple breakdown of what the query does:
-
Load External Data: It first loads a list of temporary or abused email domains from an external CSV file hosted on GitHub. This list is stored in a variable called
TempEmailAddresses. -
Filter Email Events: The query then filters email events from the
EmailEventstable that have occurred in the last 90 days. -
Check for Temporary Domains: It checks if the sender's domain or the recipient's email address matches any of the domains in the
TempEmailAddresseslist. -
Commented Out Section: There is a commented-out section that, if activated, would join the email events with URL information and summarize the data by listing URLs associated with each email, along with other details like sender, recipient, subject, and counts of attachments and URLs.
-
Reference Note: A comment at the end provides a link to a GitHub repository for a block script related to these temporary email domains.
In summary, this query is used to detect and analyze email communications involving temporary or potentially malicious email domains within a specified time frame.
Details
Jay Kerai
Released: November 29, 2024
Tables
Keywords
Operators