Rating IS Ps To Detect Potential Malicious Domains Sending Threats
Query
let CIDRASN = (externaldata (CIDR:string, CIDRASN:int, CIDRASNName:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-asn.csv.zip']with (ignoreFirstRecord=true));
EmailEvents
| evaluate ipv4_lookup(CIDRASN, SenderIPv4, CIDR, return_unmatched=true)
| extend GeoIPData = tostring(geo_info_from_ip_address(SenderIPv4).country)
| summarize Different_IPs=make_set(SenderIPv4), Countries= make_set(GeoIPData), make_set(CIDR), make_set(SenderFromDomain), Total_different_IPs=dcount(SenderIPv4) ,Total_emails = count(),make_set(ThreatTypes),Delivered_on_Inbox= countif(DeliveryLocation has "Inbox/folder"), Email_Threat= count(isnotempty(ThreatTypes)),
Email_Valid = count( isempty(ThreatTypes)) by GeoIPData, CIDR, CIDRASNName
| extend SuspiciousRatio = Email_Threat * 1.0 / Total_emails, ValidRatio = Email_Valid * 1.0 / Total_emails
| extend SuspiciousPercentage = SuspiciousRatio * 100, ValidPercentage = ValidRatio * 100
| order by Email_Threat
| project CIDRASNName,set_SenderFromDomain, set_CIDR, Different_IPs, Countries,Total_different_IPs, set_ThreatTypes,Total_emails, Delivered_on_Inbox, Email_Threat, Email_Valid, SuspiciousPercentage, ValidPercentageAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566 | Phishing |
Author: Sergio Albea (25/11/2024)
Rating ISPs to detect potential malicious domains sending threats
Description: This latest query is oriented to email threats and allows you to rate ISPs to detect:
- ISPs that are using multiple domains to send you threat emails.
- ISPs and domains with a high percentage of malicious emails, and to verify if any were delivered into Inbox folders.
- ISPs using multiple different IP addresses to send you threats.
...and more!
Explanation
This query is designed to analyze email threats by evaluating Internet Service Providers (ISPs) and their associated domains. It aims to identify potentially malicious activities by examining the following:
- Multiple Domains: It checks if ISPs are using multiple domains to send threat emails.
- Malicious Emails: It identifies ISPs and domains with a high percentage of malicious emails and checks if any of these emails were delivered to Inbox folders.
- Different IP Addresses: It detects ISPs using various IP addresses to send threats.
The query uses a dataset of IP addresses and their associated Autonomous System Numbers (ASNs) to match against the sender's IP address in email events. It then gathers information about the geographical location of the IP addresses and summarizes the data to provide insights into:
- The number of different IPs and countries involved.
- The total number of emails and how many were delivered to inboxes.
- The count of emails identified as threats versus valid emails.
- The percentage of emails that are suspicious or valid.
Finally, it orders the results by the number of email threats and presents a summary of the findings, including the ISP name, domains used, IP addresses, countries involved, and threat statistics. This helps in rating ISPs based on their potential involvement in sending malicious emails.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques