List inboxes that recieved an ISO attachment
Email ISO Attachment Recieved
Query
EmailEvents
| where EmailDirection == 'Inbound'
| join kind=inner EmailAttachmentInfo on NetworkMessageId
| project
TimeGenerated,
NetworkMessageId,
SenderFromAddress,
SenderIPv4,
SenderIPv6,
RecipientEmailAddress,
Subject,
FileName,
FileType,
ThreatNames
| where FileName endswith ".iso"About this query
Explanation
This query is designed to identify incoming emails that have ISO file attachments. ISO files can be used by attackers to deliver malware, such as Lokibot and NanoCore, to unsuspecting users. The query specifically looks for inbound emails that contain attachments with filenames ending in ".iso". It retrieves details such as the timestamp, sender and recipient email addresses, sender IP addresses, email subject, and any threat names associated with the email. This helps in identifying potential security risks where ISO files are allowed by the email system configuration, as these files could be used to gain unauthorized access to the network if opened by the recipient.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators