Malware Detections by Threat Classification

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns to deliver malware payloads, such as ransomware or remote access trojans, via inbound email attachments or links. Proactively hunting for these detections allows the SOC to identify compromised endpoints and emerging threat trends early, enabling rapid containment before lateral movement or data exfiltration occurs within the Azure environment.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Malware" and ThreatClassification has_any("Adware","Downloader","HackTool","Ransomware","Remote access trojan","Spyware")
| summarize Count = count() by ThreatClassification
| sort by Count desc
| render piechart

Analytic Rule Definition

id: c4776c7c-a8f4-4643-82db-134b771584b6
name: Malware Detections by Threat Classification
description: |
  This query summarises inbound email malware detections grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).
description-detailed: |
  This query summarises inbound email malware detections in Microsoft Defender for Office 365 grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Malware" and ThreatClassification has_any("Adware","Downloader","HackTool","Ransomware","Remote access trojan","Spyware")
  | summarize Count = count() by ThreatClassification
  | sort by Count desc
  | render piechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Malware Detections by Threat Classification.yaml)

False Positive Guidance

• IT Department Distribution of Portable Utilities: When the IT team distributes legitimate portable software (e.g., 7zip, WinSCP, or PuTTY) to multiple users via email, the executable attachments may be flagged as HackTool or Downloader by heuristic engines due to their small size and lack of digital signatures.

  • Filter/Exclusion: Exclude detections where the sender is a verified IT distribution alias (e.g., it-helpdesk@corp.com) AND the threat classification is HackTool or Downloader AND the file extension is .exe or .zip.

• Internal Test Campaigns for EDR/AV Validation: Security engineers regularly send test emails containing known benign but “noisy” files (e.g., EICAR test files or unsigned internal build artifacts) to validate that the email gateway is correctly quarantining or tagging threats. These often trigger Spyware or Adware classifications if the test file mimics common malware behavior.

  • Filter/Exclusion: Exclude detections where the subject line contains [TEST] or QA-Validation AND the recipient group is security-team@corp.com AND the threat classification is Spyware or Adware.

• Scheduled Report Attachments from Third-Party Vendors: Automated business intelligence tools (e.g., Tableau, Power BI, or SAP) send scheduled PDF or XLSX reports that may contain embedded macros or activeX controls. Some aggressive threat classifiers may flag these as Remote access trojan or Spyware if the macro behavior is misinterpreted as data exfiltration or remote control.

  • Filter/Exclusion: Exclude detections where the sender domain matches known vendor domains (e.g., @sap.com, @tableau.com) AND the file extension is .pdf or .xlsx AND the threat classification