Question
You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
```
let MaliciousEmails = [Dropdown 1]
| where MalwareFilterVerdict == "Malware"
| project TimeEmail = Timestamp, Subject, SenderFromAddress, AccountName = tostring(split(RecipientEmailAddress, "@")[0]);
MaliciousEmails
| join (
[Dropdown 2]
| project LogonTime = Timestamp, AccountName, DeviceName
) on AccountName
| where (LogonTime - TimeEmail) between (0min.. 60min)
| [Dropdown 3]
```
Explanation
Dropdown 1 is EmailEvents, the table that holds each message with its recipient, subject and malware verdict, so it can supply the malicious messages and recipient account names; EmailAttachmentInfo describes attachments only. Dropdown 2 is IdentityLogonEvents, which records sign-in activity per AccountName and lets the query compare logon time with email arrival time. Dropdown 3 is take 20, which limits the output to 20 rows as in Microsoft's own sample for this scenario; top 20 is incomplete without a by clause, and select is not a KQL operator.
