Abuse.ch Malware Submissions (MD5)

let MalwareSampleMD5 = externaldata(MD5: string)[@"https://bazaar.abuse.ch/export/txt/md5/recent"] with (format="txt", ignoreFirstRecord=True);
let MD5Regex = '[a-f0-9]{32}';
let MaliciousMD5 = materialize (
          MalwareSampleMD5
| where MD5 matches regex MD5Regex
| distinct MD5
          );
DeviceFileEvents
| where MD5 has_any (MaliciousMD5)