Question
You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel.
You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
```
EmailAttachmentInfo
| where SenderFromAddress =~ "MaliciousSender@example.com"
where isnotempty [Dropdown 1]
| join (
DeviceFileEvents
| project FileName, SHA256
) on [Dropdown 2]
| project Timestamp, FileName, SHA256, DeviceName, DeviceId, NetworkMessageId, SenderFromAddress, RecipientEmailAddress
```
Explanation
For the where isnotempty dropdown, choose (SHA256): only attachments that have a hash can be matched against device file events, so rows with an empty SHA256 are discarded before the join. EmailAttachmentInfo has no DeviceId column, and filtering on sender or recipient does not help the hash match.
For the join on dropdown, choose SHA256: it is the only column common to both sides of the join (the inner query projects only FileName and SHA256), and the requirement is to match files by their hash. Joining on DeviceId, RecipientEmailAddress or SenderFromAddress would fail because those columns are not in the DeviceFileEvents projection.
