← Back to SOC feed Coverage →

Quarantine Malware Reason

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-07T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing (T1566) to deliver malware, where the detection of quarantined emails indicates successful initial access attempts that were intercepted by email security controls. Proactively hunting for these patterns in Azure Sentinel allows the SOC to identify high-volume or targeted phishing campaigns and refine detection logic to catch threats that may bypass standard quarantine mechanisms.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound" and DetectionMethods has 'Malware' and DeliveryLocation == "Quarantine"
| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)
| where isnotempty(Malware)
| summarize count() by Malware
| sort by count_ desc
| render piechart

Analytic Rule Definition

id: 2d730733-6a56-470f-aa2c-f583611ffb50
name: Quarantine Malware Reason
description: |
  This query visualises the total amount of malware emails that are quarantined, summarized by the detection method
description-detailed: |
  This query visualises the total amount of malware emails that are quarantined, summarized by the detection method that caught them, using Advanced hunting in Microsoft Defender XDR. It completes the set alongside the equivalent phish and spam quarantine reason queries. Knowing which detection technology is filling quarantine with malware shows where protection is actually working, and a sudden shift in the mix is worth investigating: it usually means either a change in the attacks arriving or a change in which layer is catching them.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Inbound" and DetectionMethods has 'Malware' and DeliveryLocation == "Quarantine"
  | mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)
  | where isnotempty(Malware)
  | summarize count() by Malware
  | sort by count_ desc
  | render piechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Quarantine/Quarantine Malware reason.yaml