← Back to SOC feed Coverage →

Malware Detections by delivery location

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-11T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may be using specific delivery locations to distribute malware, leveraging geographic patterns to evade traditional detection methods. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential targeted campaigns and disrupt malware distribution channels.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailEvents
| where Timestamp >= TimeStart
| where DetectionMethods has "Malware" and EmailDirection == "Inbound"
| make-series TotalMalwareDetections=count(),Quarantine = countif(DeliveryLocation == "Quarantine"), Failed=countif(DeliveryLocation == "Failed") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart

Analytic Rule Definition

id: cb99e25d-bcd9-435b-ad29-de08638b0f78
name: Malware Detections by delivery location
description: |
  This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
description-detailed: |
  This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents
  | where Timestamp >= TimeStart
  | where DetectionMethods has "Malware" and EmailDirection == "Inbound"
  | make-series TotalMalwareDetections=count(),Quarantine = countif(DeliveryLocation == "Quarantine"), Failed=countif(DeliveryLocation == "Failed") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Malware Detections by Delivery Location.yaml