List inboxes that recieved an ISO attachment

Adversaries may use ISO files as email attachment to trick users into opening those malicious files. Trend Micro has done reaches on spam campgains that use ISO image files to deliver Lokibot and NanoCore malware onto victems devices. Recieving the ISO does not mean that the user is infected, depending on the malware, the user is mostly only infected after the ISO has been mapped or if files on the ISO have been opened. This query detects all inbound emails that contain a ISO image. By default ISO files are blocked in Exchange, your admin can unblock those file extensions. Thus this query should only trigger if a ISO is recieved and your admin has configured your environment in a way that ISO files are accepted.