-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathUAL-MaliciousMailAccess.kql
More file actions
11 lines (11 loc) · 977 Bytes
/
Copy pathUAL-MaliciousMailAccess.kql
File metadata and controls
11 lines (11 loc) · 977 Bytes
1
2
3
4
5
6
7
8
9
10
11
UAL
| where Operation == "MailItemsAccessed"
| extend AuditData = parse_json(AuditData)
| where AuditData.AppAccessContext.AADSessionId in ("003066ba-84c3-5438-5423-f7f392e0dbbc","00308dca-a420-2237-228b-b61ee5892f38") //Change SessionId here
| extend CreationTime = todatetime(AuditData.CreationTime),UserId = tostring(AuditData.UserId),ClientIP = tostring(AuditData.ClientIPAddress),SessionId = tostring(AuditData.AppAccessContext.AADSessionId)
| mv-expand Folder = AuditData.Folders
| mv-expand Item = Folder.FolderItems
| extend InternetMessageId = tostring(Item.InternetMessageId),Subject = tostring(Item.Subject),ItemCreationTime = todatetime(Item.CreationTime),SizeInBytes = tolong(Item.SizeInBytes),FolderPath = tostring(Folder.Path)
| where isnotempty(InternetMessageId)
| project TimeGenerated=CreationTime,ItemCreationTime,UserId,ClientIP,SessionId,FolderPath,InternetMessageId,Subject,SizeInBytes,RecordId
| summarize arg_min(TimeGenerated, *) by InternetMessageId