AsyncRAT Initial Access Campaign via OneNote files

In recent days there has been a increase in malicious OneNote files to deliver AsyncRAT. This query can be used to start a hunt for malicious files in your environment. The OneNote files have to be delivered by mail and have to be opened in order to pop-up in the results of this query. This will indicate that a user has opened the attachment from the mail. From there a investigation needs to be started to determin if the file is benign or malicious. This query cannot determine if the OneNote file was malicious. It will only give an indication based on the sender and filename.