KQL Search

Query Details

Unexpected Attachment Types In Emails

Query

//After Hunting consider adding attachment types in AntiMalware policy to quarantine/reject emails containing unexpected attachment types - the supplied list includes CIS baseline, the common attachment filter and some additional extension types.
let ExtensionList = externaldata(extension: string)[@"https://raw.githubusercontent.com/jkerai1/TLD-TABL-Block/refs/heads/main/FileExtensionsForAntiMalwarePolicy.csv"] with (format="csv", ignoreFirstRecord=True)
| extend extension = strcat(".",extension);
EmailAttachmentInfo
| where TimeGenerated > ago(90d)
| where FileExtension in(ExtensionList)
| join EmailEvents on NetworkMessageId
//| where DeliveryAction != @"Delivered" //if you wish to filter out what was already blocked

Explanation

This query is designed to help identify potentially harmful email attachments based on their file extensions. Here's a simplified explanation of what it does:

  1. Load a List of Suspicious Extensions: It starts by loading a list of file extensions from an external CSV file hosted on GitHub. These extensions are considered suspicious or unexpected and might be used in malicious email attachments.

  2. Format the Extensions: Each extension from the list is prefixed with a dot (e.g., ".exe", ".zip") to match the format typically used in file names.

  3. Filter Email Attachments: The query then looks at email attachment data from the past 90 days.

  4. Identify Matches: It filters this data to find attachments with file extensions that match those in the suspicious list.

  5. Join with Email Events: The query joins this filtered attachment data with email event data using a common identifier (NetworkMessageId) to provide context about the emails containing these attachments.

  6. Optional Filtering: There's a commented-out line that, if activated, would exclude emails that have already been blocked or quarantined, focusing only on those that were delivered.

The overall goal is to help security teams identify emails with potentially dangerous attachments so they can adjust their anti-malware policies to quarantine or reject such emails in the future.