← Back to SOC feed Coverage →

Malware Detection IP and Geo Position

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-03T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) to deliver malware via email, where mapping sender IP addresses and geographic locations helps identify suspicious or inconsistent origin points. Proactively hunting for these patterns in Azure Sentinel allows the SOC to detect potential supply chain attacks or compromised senders before they result in widespread endpoint infections.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Malware" and isnotempty(SenderIPv4)
| summarize count() by SenderIPv4
| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)
| project SenderIPv4, Latitude, Longitude, ['Malware Emails'] = count_

Analytic Rule Definition

id: ecd834a7-cd3e-4932-afa3-25465fe41401
name: Malware Detection IP and Geo Position
description: |
  This query summarises inbound email malware detections by sender IP address with geographic coordinates for mapping.
description-detailed: |
  This query summarises inbound email malware detections in Microsoft Defender for Office 365 by sender IPv4 address, resolving each IP to its geographic latitude and longitude using geo_info_from_ip_address so the sending infrastructure can be plotted on a map.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Malware" and isnotempty(SenderIPv4)
  | summarize count() by SenderIPv4
  | extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
  | extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)
  | project SenderIPv4, Latitude, Longitude, ['Malware Emails'] = count_
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Malware Detection IP and Geo Position.yaml