Defender for Office 365 - QRCodes
MDO QR Code
Query
EmailUrlInfo
| where UrlLocation == 'QRCode'
| project Url, UrlLocation, UrlDomainAbout this query
Explanation
These queries help identify emails with QR codes, including the volume of inbound emails with QR codes, emails delivered with URLs in the form of QR codes, emails with suspicious keywords in the subject, and emails with QR codes from non-prevalent senders. There is also a detection rule to identify emails with QR codes from non-prevalent senders.
Details
Alex Verboon
Released: June 24, 2024
Tables
EmailUrlInfo
EmailEvents
Keywords
EmailUrlInfoUrlLocationUrlDomainEmailEventsTimeGeneratedEmailDirectionNetworkMessageIdDeliveryActionSenderFromAddressSubjectUrlSubjectKeywordsTotalEmailCountQR_from_non_prevalentQRCode_emailsnMIDssenders_NMIDsRecipientEmailAddressInternetMessageIdRecipientObjectIdReportIdsenderprevalencesendersnMIDs_from_non_prevalent_SendersReportId.
Operators
whereprojectjoinsummarizerenderhas_anypack_arraydistinctisnotemptybinagocountinkind