MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1566.001Spearphishing Attachment

Initial Access

View on MITRE ATT&CK →

2 Queries

Email with Suspicious Attachment File Type Delivered

highproductionMicrosoft Sentinel

Microsoft Defender for Office 365·EmailEventsEmailAttachmentInfo

EmailEvents
| where Timestamp > ago(1d)
| where DeliveryAction == "Delivered"
| join kind=inner EmailAttachmentInfo on NetworkMessageId
| where FileType in~ ("exe", "dll", "scr", "hta", "vbs", "js", "wsf", "iso", "img", "vhd", "lnk", "docm", "xlsm", "pptm")
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, FileName, FileType, SHA256, DeliveryAction
| sort by Timestamp desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

Tuning notes

Expand or reduce the FileType list based on your org's email security policy. Consider excluding internal relay addresses from SenderFromAddress.

+ Add another query for this technique →