Adversaries are increasingly leveraging QR codes in inbound emails to bypass traditional URL filtering and direct users to malicious landing pages, aligning with the Phishing technique (T1566). Proactively hunting for this trend in Azure Sentinel allows the SOC to identify emerging phishing campaigns that exploit visual obfuscation before they result in credential theft or malware execution.
let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let qrMessages = EmailUrlInfo
| where Timestamp >= TimeStart
| where UrlLocation == "QRCode"
| distinct NetworkMessageId;
EmailEvents
| where Timestamp >= TimeStart
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| where EmailDirection == "Inbound" and DetectionMethods has "Url"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where NetworkMessageId in (qrMessages)
| make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has "URL"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has "URL"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has "URL") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart
id: aa121105-95a2-4424-84d7-1c5c47e5d44b
name: QR Code URL Detections Trend
description: |
This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam).
description-detailed: |
This query visualises inbound email detections in Microsoft Defender for Office 365 where the malicious URL was embedded in a QR code (EmailUrlInfo UrlLocation == "QRCode"), over time and split by whether the URL was flagged for phishing, malware or spam. Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
- EmailUrlInfo
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let qrMessages = EmailUrlInfo
| where Timestamp >= TimeStart
| where UrlLocation == "QRCode"
| distinct NetworkMessageId;
EmailEvents
| where Timestamp >= TimeStart
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| where EmailDirection == "Inbound" and DetectionMethods has "Url"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where NetworkMessageId in (qrMessages)
| make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has "URL"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has "URL"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has "URL") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
EmailEvents | Ensure this data connector is enabled |
EmailUrlInfo | Ensure this data connector is enabled |
@service-now.com, @jira.com) AND the subject line contains keywords like “Ticket Status”, “Update”, or “Resolution”.@workday.com, @bamboohr.com) where the body contains phrases like “Onboarding”, “Offboarding”, “Acknowledge”, or “Sign here”.@gusto.com, @adp.com) where the subject line includes “Pay Stub”, “Benefits”, “Bank Details”, or “Review”.