Email & Phishing

KQL Library / Email & Phishing

Defender for Office 365 queries against `EmailEvents` — phishing volume, malware, and external-account abuse patterns.

External Email Accounts Synced To Outlook Sending Attachments external-email-accounts-synced-to-outlook-sending-attachments.kql
Employees using Outlook on corporate machines to send email via third-party SMTP servers, with attachments — a common data-exfiltration pattern.
Top Blocked Malware Email Events top-blocked-malware-email-events.kql
Top blocked malware email events. Does what it says on the tin.
Top Phishing Domains top-phishing-domains.kql
Top phishing *sender domains* with severity categorized by volume.
Top Phishing Sender Recipient Pairs top-phishing-sender-recipient-pairs.kql
Top phishing volume grouped by *(recipient, sender-domain)* pair — useful for spotting targeted campaigns against specific users.
Top Phishing Targets top-phishing-targets.kql
Top *recipients* of phishing emails (targeted individuals) with severity by volume.
Whos Clicking On Junk Mail whos-clicking-on-junk-mail.kql
Users who clicked links in messages that landed in the Junk folder — a strong "who needs training" signal.