Microsoft 365 Defender - Emails Indicators Hunt

This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. SHA256 - Emails with attachments matching the "SHA256" input are retrieved. URLDomain - If the "URLDomain" value is found as a substring of URL(s) in the body of the email, the email is retrieved. IPAddress - Emails with "SenderIPv4"/SenderIPv6" or URLs (in the body) matching the "IPAddress" input are retrieved.

Microsoft 365 Defender · 15 tasks · 7 inputs · 23 outputs

Inputs

  • URLDomain — Domain or URL to search within emails. Can be a single domain or URL or an array of domains or URLs to search. The search looks for the exact Domain or URL.
  • SHA256 — The SHA256 hash file or an array of hashes to search within emails.
  • IPAddress — The source or destination IP address to search. Can be a single address or an array of IP addresses.
  • Timeout — The time limit in seconds for the HTTP request to run. Default is 180.
  • SearchTimeframe — Number of days past to search. Default is 7.
  • ResultsLimit — Number of retrieved entries. Enter -1 for unlimited query. 50 is the default.
  • ListenerMailbox — The mailbox of the listening integration. In case it is provided, the emails found in it will be ignored.

Outputs

  • Microsoft365Defender.RetrievedEmails — Email objects containing relevant fields.
  • Microsoft365Defender.RetrievedEmails.InternetMessageId — Internet Message ID of the email.
  • Microsoft365Defender.RetrievedEmails.SenderFromDomain — Sender domain.
  • Microsoft365Defender.RetrievedEmails.EmailDirection — Email direction (inbound/outbound).
  • Microsoft365Defender.RetrievedEmails.DeliveryLocation — Delivery location.
  • Microsoft365Defender.RetrievedEmails.AuthenticationDetails — Authentication details (SPF, DKIM, DMARC, CompAuth).
  • Microsoft365Defender.RetrievedEmails.DeliveryAction — Delivery action.
  • Microsoft365Defender.RetrievedEmails.Subject — Email subject.
  • Microsoft365Defender.RetrievedEmails.AttachmentCount — Number of attachments.
  • Microsoft365Defender.RetrievedEmails.ThreatNames — Threat names.
  • Microsoft365Defender.RetrievedEmails.RecipientEmailAddress — Recipient email address.
  • Microsoft365Defender.RetrievedEmails.EmailAction — Email action.
  • Microsoft365Defender.RetrievedEmails.EmailLanguage — Email language.
  • Microsoft365Defender.RetrievedEmails.SenderFromAddress — Sender address.
  • Microsoft365Defender.RetrievedEmails.Timestamp — Timestamp.
  • Microsoft365Defender.RetrievedEmails.SenderDisplayName — Sender display name.
  • Microsoft365Defender.RetrievedEmails.SenderIPv4 — Sender IPv4
  • Microsoft365Defender.RetrievedEmails.ConfidenceLevel — Confidence level.
  • Microsoft365Defender.RetrievedEmails.ThreatTypes — Threat types.
  • Microsoft365Defender.RetrievedEmails.SHA256 — SHA256 of the attachments (if exists in the email).
  • Microsoft365Defender.RetrievedEmails.Url — URLs found in the email's body.
  • Microsoft365Defender.RetrievedEmails.UrlCount — Number of URLs found in the email's body.
  • Microsoft365Defender.RetrievedEmails.SenderIPv6 — Sender IPv6.

Commands used

microsoft-365-defender-advanced-hunting

Flowchart

no yes yes yes URLDomain Exists SHA256 Exists IPAddress Exists Start Start Check if Microsoft 365 Defender is enabled - IsIntegrationAvailable Check if Microsoft 365 De... IsIntegrationAvailable URLDomain input exists? URLDomain input exists? SHA256 input exists? SHA256 input exists? Done Done Retrieve emails data (URLDomain) - microsoft-365-defender-advanced-hunting Retrieve emails data (URL... microsoft-365-defender-advanc... Retrieve emails data (SHA256) - microsoft-365-defender-advanced-hunting Retrieve emails data (SHA... microsoft-365-defender-advanc... Save matching email results (with URLs or attachments) - SetAndHandleEmpty Save matching email resul... SetAndHandleEmpty Set URLDomain search argument - Set Set URLDomain search argu... Set Set SHA256 search argument - Set Set SHA256 search argument Set IPAddress input exists? IPAddress input exists? Set IPAddress search argument - Set Set IPAddress search argu... Set Retrieve emails data (IPAddress) - EmailEvents table - microsoft-365-defender-advanced-hunting Retrieve emails data (IPA... microsoft-365-defender-advanc... Save matching email results (based on sender IP) - SetAndHandleEmpty Save matching email resul... SetAndHandleEmpty Retrieve emails data (IPAddress) - EmailUrlInfo table - microsoft-365-defender-advanced-hunting Retrieve emails data (IPA... microsoft-365-defender-advanc...