product

Microsoft Defender for Office 365

Microsoft Defender for Office 365 provides advanced protection for email and collaboration workloads against phishing, malware, and other email-based threats.

productsMDOCurrent

Relationships

Related KQL

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template

intermediatephishinguser-compromise

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents EmailUrlInfo UrlClickEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.

Summarize inbound email authentication failures

Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.

template

intermediatephishing

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.