IC Catching Emojis Into Email Attachment Files Names
Query
// Sergio Albea 16-03-2026 ©️
EmailAttachmentInfo
| where Timestamp > ago(7d) and isnotempty(FileExtension) and isnotempty(FileName)
| extend Icons = extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", FileName)
| where isnotempty(Icons)
| join kind=inner (EmailEvents) on NetworkMessageId
| extend SenderIP = iff(isnotempty(SenderIPv4),SenderIPv4,SenderIPv6)
| extend geo_ip = tostring(geo_info_from_ip_address(SenderIP).country)
| project Timestamp,SenderDisplayName,SenderFromAddress,SenderIP,geo_ip,FileName,FileExtension,RecipientEmailAddress,Icons
| order by Timestamp descAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.001 | Phishing: Spearphishing Attachment |
Author: Sergio Albea (17/03/2026)
[IC] - Catching Emojis into Email Attachment Files names
| Technique ID | Title |
|---|---|
| T1036 | Masquerading |
| Author | Sergio Albea (16/03/2026) |
|---|
Attackers take advantage of the emojis because they help the content stand out and gets more attention than plain text. It not apply just to Email Subject if not that it also applies to Attachment Files which based on my experience, legitime file not use to have icons in their file names.For example:
- 📄Invoice.pdf
- 🔐Reset_Password.html
- 📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
Explanation
This query is designed to detect potentially suspicious email attachments that use emojis in their file names, which can be a tactic used by attackers to make malicious files more noticeable and enticing. Here's a simplified breakdown of what the query does:
-
Data Source: The query starts by looking at email attachment information from the past 7 days.
-
Filtering: It filters out entries where the file extension or file name is missing, as these are necessary for further analysis.
-
Emoji Detection: It checks the file names for the presence of emojis, which are identified by specific Unicode ranges.
-
Joining Data: The query then joins this information with email event data to get more context about the emails, such as the sender's information.
-
Sender Information: It extracts the sender's IP address and determines the country of origin using geolocation data.
-
Output: The query outputs a list of emails with suspicious attachments, displaying details like the timestamp, sender's name and address, sender's IP and country, file name and extension, recipient's email address, and the detected emojis.
-
Sorting: Finally, it sorts the results by the timestamp in descending order, showing the most recent events first.
Overall, this query helps identify potentially malicious email attachments that use emojis to catch the recipient's attention, which is a form of masquerading as described in the MITRE ATT&CK framework.
