Typosquatted Email Received
Email Typosquatted Email Recieved
Query
let Domain = tolower("kqlquery.com");
let UnicodeDomain = unicode_codepoints_from_string(Domain);
let TypoSquatMin = 0.75;
let TypoSquatMax = 0.99; // If set to 1.0 it equals the domain.
EmailEvents
| where EmailDirection == "Inbound"
| extend SenderDomainUnicode = unicode_codepoints_from_string(tolower(SenderFromDomain))
| extend TypoSquadPercentage = jaccard_index(UnicodeDomain, SenderDomainUnicode)
| where TypoSquadPercentage between (TypoSquatMin .. TypoSquatMax)
| project-reorder Timestamp, SenderFromDomain, TypoSquadPercentage, RecipientEmailAddress, SubjectAbout this query
Explanation
This query is designed to detect potential phishing attempts by identifying emails sent from domains that closely resemble your organization's domain, a tactic known as "typosquatting." Here's a simple breakdown of what the query does:
-
Domain Setup: It starts by defining your organization's domain, in this case, "kqlquery.com," and converts it into a format that can be compared with other domains.
-
Thresholds: It sets two thresholds,
TypoSquatMinandTypoSquatMax, which determine how similar a domain must be to your domain to be considered suspicious. These thresholds are set between 0.75 and 0.99, meaning the suspicious domain must be between 75% and 99% similar to your domain. -
Email Filtering: The query looks at inbound emails and calculates how similar the sender's domain is to your domain using a method called the Jaccard index, which measures similarity between two sets of characters.
-
Suspicious Emails: It filters out emails where the sender's domain similarity falls within the defined thresholds, indicating potential typosquatting.
-
Output: Finally, it organizes the results to show the timestamp, sender's domain, similarity percentage, recipient's email address, and email subject, helping you quickly identify and investigate suspicious emails.
This query helps in proactively identifying and mitigating phishing risks by flagging emails from domains that are deceptively similar to your own.
