ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Case File • Email Security • Attachments • Defender XDR • Endpoint Correlation • KQL

The User Deleted the Email — The Attacker Already Had the Attachment

The user recognised the message was suspicious.

They deleted it.

Problem solved?

Not necessarily.

The email timeline showed delivery. The attachment evidence identified the file. And the endpoint telemetry showed something more important:

the attachment had already reached the device before the email disappeared from the mailbox.

Agent Foskett reconstructed what happened before deletion became the final event everyone remembered.

Discuss Email SecurityBack to investigations
Agent Foskett correlating suspicious email attachment and endpoint activity in Microsoft Defender XDR
Deletion Wasn't the Beginning

Removing a suspicious email can reduce future exposure, but it does not erase actions that already occurred. The investigation has to move backwards through the timeline.

✓ Email delivered
✓ Attachment identified
✓ Endpoint activity correlated

The user did the right thing — but deletion didn't end the investigation

The user realised the email looked suspicious and deleted it. From the mailbox view, the threat appeared to be gone.

That was useful containment, but deletion answered only one question: is the message still sitting there now?

It did not answer the more important question: what happened while the message was still present?

If the attachment had already been saved, opened or triggered activity, the investigation had moved beyond email.
Mailbox stateThe message was no longer visible to the user.
Historical evidenceDefender telemetry could still show delivery and attachment details.
Endpoint evidenceThe device could reveal whether the file appeared or activity followed.

Start with the message, not the user's memory

Users often remember the final action: “I deleted it.” The investigation needs the full sequence. In Microsoft Defender XDR Advanced Hunting, begin with EmailEvents to establish when the message arrived, who received it and the network message identifier used for further pivots.
email-delivery-timeline.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
let Recipient = "user@contoso.com";
EmailEvents
| where Timestamp > ago(7d)
| where RecipientEmailAddress =~ Recipient
| project Timestamp,
          NetworkMessageId,
          SenderFromAddress,
          SenderMailFromAddress,
          Subject,
          DeliveryAction,
          DeliveryLocation,
          ThreatTypes
| order by Timestamp desc

Identify the attachment

Once the relevant message is identified, pivot to EmailAttachmentInfo. This can establish the attachment name, file type and hash values available in email telemetry. Those values become the bridge from the message to the endpoint investigation.
attachment-evidence.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
let MessageId = "NETWORK-MESSAGE-ID-HERE";
EmailAttachmentInfo
| where Timestamp > ago(7d)
| where NetworkMessageId == MessageId
| project Timestamp,
          NetworkMessageId,
          RecipientEmailAddress,
          FileName,
          FileType,
          SHA256,
          ThreatTypes

Did the attachment reach an endpoint?

Now pivot on the attachment hash in DeviceFileEvents. A matching file event can show whether the attachment appeared on a device and where it was written. This does not by itself prove execution, but it establishes that the investigation is no longer confined to the mailbox.
attachment-on-endpoint.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
let AttachmentSHA256 = "SHA256-HERE";
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 == AttachmentSHA256
| project Timestamp,
          DeviceName,
          ActionType,
          FileName,
          FolderPath,
          SHA256,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Was there execution or follow-on activity?

A file appearing on disk is different from a file being executed. Use DeviceProcessEvents to search for the attachment name in process and initiating-process command lines, then inspect the surrounding process tree. Documents and archives may lead to child processes rather than becoming executable processes themselves.
attachment-execution.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
let AttachmentName = "Invoice.pdf";
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ AttachmentName
   or ProcessCommandLine has AttachmentName
   or InitiatingProcessCommandLine has AttachmentName
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          SHA256
| order by Timestamp asc

Build the timeline backwards from deletion

The user's deletion may be the last visible event, but the investigation should reconstruct everything before it.

For example: the email arrives, the attachment is exposed to the user, the file appears on the endpoint, process or network activity follows, and only then is the email deleted.

Deleting the message does not delete the timeline.
08:41 — DeliveredThe suspicious message reaches the recipient.
08:46 — Attachment activityThe file appears on the endpoint and requires further investigation.
08:53 — DeletedThe user removes the message, but the earlier endpoint evidence remains.

What Agent Foskett checked

Email deliveryWhen did the message arrive and where was it delivered?
Attachment identityWhat filename, file type and hash were associated with the message?
Endpoint presenceDid the same file appear on a protected device?
ExecutionWas there evidence that the attachment or related content caused process activity?
Network behaviourDid suspicious communication follow the interaction?
SequenceDid risky activity happen before the user deleted the message?

What the evidence can and cannot prove

An attachment appearing on disk does not automatically prove that malicious code executed. Likewise, a user deleting an email does not prove they opened the attachment.

Email and endpoint telemetry must be correlated carefully. Filename matches alone can be ambiguous; hashes, device context, timestamps, process ancestry and surrounding activity strengthen the conclusion.

The goal is to determine what actually happened and contain any activity that survived the email's deletion.

The lesson

The user deleted the email.

That was the correct action once they recognised the risk.

But deletion was not evidence that nothing had happened before it.

Agent Foskett followed the message into the attachment telemetry, then followed the attachment onto the endpoint.

The mailbox told him the email was gone. The endpoint told him whether the risk had already moved somewhere else.
Investigation principle: Removing the message is containment. Reconstructing what happened before removal is investigation.

Related investigations

Agent Foskett InvestigationsContinue through the complete collection of real-world Microsoft security investigations.Who is Agent Foskett?Meet the investigator behind the case files and the principle: follow the evidence.SOC Analyst AcademyBuild practical investigation and triage skills across identity, endpoint, email and cloud security.
The email was gone. The evidence wasn't.
Follow the attachment from the mailbox to the endpoint.
Continue the Investigation

Final thought

Containment changes what can happen next. It does not rewrite what happened before.

When a suspicious email has already been opened or its attachment may have been accessed, the investigation must cross the boundary between email and endpoint telemetry.

Follow the evidence. Build the timeline.

The Logs Already Knew! 🔎
Develop IT.. Protect IT.. GEMXIT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The User Deleted the Email — The Attacker Already Had the Attachment

This Agent Foskett case file examines a Microsoft Defender XDR investigation where a suspicious email was deleted after its attachment had already reached an endpoint.

Email Attachment Investigation With Microsoft Defender XDR and KQL

Use EmailEvents, EmailAttachmentInfo, DeviceFileEvents and DeviceProcessEvents to correlate message delivery, attachment hashes, endpoint file activity and execution evidence across an incident timeline.

Deleting a Suspicious Email Does Not End the Investigation

Email deletion can contain future exposure, but analysts should reconstruct what happened before removal to determine whether an attachment was saved, opened, executed or followed by suspicious endpoint behaviour.