← Back to SOC feed Coverage →

files-from-malicious-sender

kql MEDIUM Azure-Sentinel
DeviceFileEventsEmailAttachmentInfo
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-23T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use known malicious email addresses to exfiltrate data or deploy malware by sending malicious files to internal systems. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential lateral movement or data compromise early.

KQL Query

//Get prevalence of files sent by a malicious sender in your organization
EmailAttachmentInfo
| where SenderFromAddress =~ "[email protected]"
| where isnotempty(SHA256)
| join (
DeviceFileEvents
| project FileName, SHA256
) on SHA256

Analytic Rule Definition

id: 43625c12-5712-44df-8741-c334746aeccc
name: files-from-malicious-sender
description: |
  This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailAttachmentInfo
  - DeviceFileEvents
tactics:
- Initial access
query: |
  //Get prevalence of files sent by a malicious sender in your organization
  EmailAttachmentInfo
  | where SenderFromAddress =~ "[email protected]"
  | where isnotempty(SHA256)
  | join (
  DeviceFileEvents
  | project FileName, SHA256
  ) on SHA256

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled
EmailAttachmentInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Initial access/files-from-malicious-sender.yaml