Question
You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
```
EmailAttachmentInfo
| where SenderFromAddress =~ "MaliciousSender@example.com"
| where isnotempty(SHA256)
| [Dropdown 1] (
DeviceFileEvents
| [Dropdown 2] FileName, SHA256
) on SHA256
| [Dropdown 3] Timestamp, FileName, SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress
```
Explanation
Dropdown 1 is join: the attachments from the malicious sender must be matched to device file activity on a common column, which is what join (...) on SHA256 does; union would just append the rows of both tables without matching them. Dropdown 2 is project, which keeps only the FileName and SHA256 columns from DeviceFileEvents before the join; extend would add columns instead of selecting them. Dropdown 3 is project again, selecting the final set of columns to display, including the device and the email details.
