← Back to SOC feed Coverage →

Emails with QR codes from non-prevalent sender

kql MEDIUM Azure-Sentinel
T1566
EmailEventsEmailUrlInfo
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-17T11:00:00Z · Confidence: medium

Hunt Hypothesis

Emails containing QR codes from non-prevalent senders may indicate an attempt to deliver malicious payloads through encoded URLs, as adversaries often use QR codes to bypass traditional email filtering. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential phishing or credential theft campaigns that evade standard detection mechanisms.

KQL Query

let senderprevalence =
EmailEvents
| where Timestamp between (ago(7d)..(now()-24h))
| where isnotempty(SenderFromAddress)
| summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress
| where TotalEmailCount > 1;
let prevalent_Sender = senderprevalence
| where isnotempty (SenderFromAddress)
| distinct SenderFromAddress;
let QR_from_non_prevalent =
EmailEvents
| where EmailDirection == "Inbound"
| where Timestamp > ago(1d)
| where SenderFromAddress !in (prevalent_Sender)
| join EmailUrlInfo on NetworkMessageId
| where UrlLocation == "QRCode"
| distinct SenderFromAddress,Url,NetworkMessageId;
QR_from_non_prevalent

Analytic Rule Definition

id: f708c866-073a-4107-a60b-ba6f86e54caa
name: Emails with QR codes from non-prevalent sender
description: |
  In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders
description-detailed: |
  In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders using Defender for Office 365 data.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let senderprevalence =
  EmailEvents
  | where Timestamp between (ago(7d)..(now()-24h))
  | where isnotempty(SenderFromAddress)
  | summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress
  | where TotalEmailCount > 1;
  let prevalent_Sender = senderprevalence
  | where isnotempty (SenderFromAddress)
  | distinct SenderFromAddress;
  let QR_from_non_prevalent =
  EmailEvents
  | where EmailDirection == "Inbound"
  | where Timestamp > ago(1d)
  | where SenderFromAddress !in (prevalent_Sender)
  | join EmailUrlInfo on NetworkMessageId
  | where UrlLocation == "QRCode"
  | distinct SenderFromAddress,Url,NetworkMessageId;
  QR_from_non_prevalent
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled
EmailUrlInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/QR code/Emails with QR codes from non-prevalent sender.yaml