IC Catching Emojis On Email Subjects
Query
// Sergio Albea 17-03-2026 ©️
EmailEvents
| where Timestamp > ago(7d)
| where isnotempty(Subject)
| extend Icons = extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", Subject)
| where isnotempty(Icons)
| join kind=inner UrlClickEvents on NetworkMessageId
| where UserLevelPolicy !has 'Allow'
| where OrgLevelPolicy !has 'Allow'
| extend SenderIP = iff(isnotempty( SenderIPv4),SenderIPv4,SenderIPv6)
| extend geo_ip = tostring(geo_info_from_ip_address(SenderIP).country)
//| where Subject contains "⚠️"
| summarize Distinct_Recipients=dcount(RecipientEmailAddress),make_set(RecipientEmailAddress),Emails=count() by Subject,SenderIP,geo_ip,ActionType, Workload, Url, ThreatTypes, LatestDeliveryLocation
| order by Emails, Distinct_RecipientsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.002 | Phishing: Spearphishing Link |
Author: Sergio Albea (05/06/2026)
[IC] - Catching emojis on email Subjects
| Technique ID | Title |
|---|---|
| T1566 | Phishing |
| Author | Sergio Albea (17/03/2026) |
|---|
Marketing emails use Emojis all the time… but attackers use them too because they catch attention and increase the chance someone clicks:
- ⚠️ Urgent messages
- 📦 Delivery notifications
- 📄 Fake invoices
- 🔐 Password resets
Identify and classify cases on Email Subjects can be converted in useful detections. It query identify:
- Emails received with icons in the subject
- Where the URL was clicked
- Excluding cases where the sender is added as allowed either in the organization or user level
- Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
Explanation
This query is designed to detect potential phishing attempts in emails by focusing on emails with emojis in their subject lines. Here's a simple breakdown of what the query does:
-
Time Frame: It looks at emails received in the last 7 days.
-
Emoji Detection: It identifies emails that have emojis in their subject lines. Emojis are often used to grab attention, which can be a tactic used in phishing.
-
URL Click Tracking: It checks if any URLs in these emails were clicked, which could indicate engagement with potentially malicious content.
-
Exclusion Criteria: It excludes emails from analysis if the sender is on an allowed list, either at the organization level or user level.
-
Sender Information: It extracts the sender's IP address and determines the country of origin for further analysis.
-
Summary and Classification: It summarizes the data by counting the number of emails, the number of unique recipients, and checks if the emails were delivered to inbox folders. It also provides details like the sender's IP, geographic location, action type, workload, URL, threat types, and the latest delivery location.
-
Output: The results are ordered by the number of emails and distinct recipients, helping to prioritize which emails might need further investigation.
Overall, this query helps identify and classify potentially suspicious emails that use emojis to attract attention, providing insights into possible phishing activities.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators