← Back to SOC feed Coverage →

IcedId email delivery

kql MEDIUM Azure-Sentinel
EmailEventsEmailUrlInfo
huntingmicrosoftofficialransomware
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-25T23:00:00Z · Confidence: medium

Hunt Hypothesis

The IcedId email delivery detection rule identifies potential adversary activity where malicious emails are used to deliver the IcedId malware, which can lead to ransomware deployment. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate early-stage phishing campaigns that could escalate to data exfiltration or ransomware attacks.

KQL Query

EmailUrlInfo 
| where Url matches regex @"\bsites\.google\.com\/view\/(?:id)?\d{9,}\b" 
| join EmailEvents on NetworkMessageId // Note: Replace the following subject lines with the one generated by your website's Contact submission form if no results return initially 
| where Subject has_any('Contact Us', 'New Submission', 'Contact Form', 'Form submission')

Analytic Rule Definition

id: 1d8393fe-e363-40c1-8efb-66cf1ad68a05
name: IcedId email delivery
description: |
  Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
  - EmailEvents
tactics:
- Initial access
- Ransomware
query: |
  EmailUrlInfo 
  | where Url matches regex @"\bsites\.google\.com\/view\/(?:id)?\d{9,}\b" 
  | join EmailEvents on NetworkMessageId // Note: Replace the following subject lines with the one generated by your website's Contact submission form if no results return initially 
  | where Subject has_any('Contact Us', 'New Submission', 'Contact Form', 'Form submission')

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled
EmailUrlInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Ransomware/IcedId email delivery.yaml