Top Blocked Malware Email Events

KQL Library / Email & Phishing

Email & Phishing top-blocked-malware-email-events.kql

Top blocked malware email events. Does what it says on the tin.

Tactics Initial Access

Techniques T1566.001

Platforms Microsoft 365

Data EmailEvents

Deep Dive Deep Dive

Deep Dive Download .kql

// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Does exactly what it says on the tin 
// Source: KQL Toolbox #5: Phishing & Malware Hunting (2026-01-25) — https://www.hanley.cloud/2026-01-25-KQL-Toolbox-5-Phishing-%26-Malware-Hunting/
// Tactics: Initial Access
// Techniques: T1566.001
// Platforms: Microsoft 365
// Data: EmailEvents

EmailEvents
| where ThreatTypes has "Malware"
| summarize MalwareEmailsQuarantined = count() by bin(Timestamp, 1d), RecipientEmailAddress, SenderFromDomain
| order by Timestamp desc