
Explanation:

For hunting in Microsoft 365 Defender , email at tachment metadata is in EmailAttachmentInfo (fields include Timestamp , FileName , SHA256 , NetworkMessageId , etc.). To return every email that contains a specific attachment and optimize performance , apply time filters as early as possible and avoid unnecess ary joins. Early filtering reduces the dataset to scan and speeds execution.
A performant query that meets "only last hour" and the attachment name requirement is:
EmailAttachmentInfo
| where Timestamp > ago(1h) // filter early for perf ormance
| where Subject == " Document Attachment " and FileName == " Document.pdf "
| where Timestamp > ago(1h) // (idempotent second constraint; harmless) Using joins (e.g., to DeviceFileEvents on SHA256 ) is not required to answer the question and would add overhead. The key is to filter on Timestamp and FileName within EmailAttachmentInfo , ensuring only emails from the last hour with Document.pdf are returned while keeping the query efficient.