Skip to content

Instantly share code, notes, and snippets.

@alexmags

alexmags/EmailAttachmentInfo.kql

Last active February 26, 2022 09:06
Show Gist options
  • Save alexmags/5f979eeed50219ad9b19cfddd620e232 to your computer and use it in GitHub Desktop.
Save alexmags/5f979eeed50219ad9b19cfddd620e232 to your computer and use it in GitHub Desktop.
Download ZIP
KQL to track where an email attachment went. Sensitivity of file isn't recorded here unfortunately. https://blog.alexmags.com/posts/exchange-online-email-investigation/
Raw
EmailAttachmentInfo.kql
EmailAttachmentInfo
| where SHA256 == '<File hash here>' // or you can filter by filename
| order by Timestamp asc
//| project Timestamp, SenderFromAddress, RecipientEmailAddress, FileName, FileSize, FileType, NetworkMessageId, ReportId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment