Blocked URL Clicks by Workload

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) to deliver malicious payloads via links that are subsequently blocked by Safe Links, indicating active user engagement with suspicious content across various M365 workloads. Proactively hunting for these blocked clicks allows the SOC to identify high-risk users or compromised accounts attempting to bypass security controls, enabling rapid investigation before a successful compromise occurs.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
UrlClickEvents
| where Timestamp >= TimeStart
| where ActionType == "ClickBlocked"
| make-series Teams = countif(Workload == "Teams"), Office = countif(Workload == "Office"), Email = countif(Workload == "Email"), Copilot = countif(Workload == "Copilot") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart

Analytic Rule Definition

id: 41831d30-f03e-44a9-bd27-f713033393b7
name: Blocked URL Clicks by Workload
description: |
  This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot).
description-detailed: |
  This query visualises Safe Links URL clicks that were blocked (ActionType == "ClickBlocked") over time in Microsoft Defender for Office 365, broken down by the workload the click originated from (Email, Teams, Office, Microsoft 365 Copilot), to show where users most often attempt to reach malicious URLs.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  UrlClickEvents
  | where Timestamp >= TimeStart
  | where ActionType == "ClickBlocked"
  | make-series Teams = countif(Workload == "Teams"), Office = countif(Workload == "Office"), Email = countif(Workload == "Email"), Copilot = countif(Workload == "Copilot") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL Click/Blocked URL Clicks by Workload.yaml)

False Positive Guidance

• Scenario: Automated security testing or penetration testing where a security team (e.g., using tools like Nessus or Burp Suite) intentionally clicks Safe Links URLs in test emails to verify that the protection policy is active and functioning correctly.

  • Filter/Exclusion: Exclude clicks where the user account name matches known test accounts (e.g., sec-test-*, pentest-*) or where the source IP address falls within the designated security lab subnet (e.g., 10.20.50.0/24).

• Scenario: IT administrators or support staff manually validating new email templates or onboarding packets by clicking links in test messages sent to a distribution group or specific admin mailboxes (e.g., it-support@company.com, admin-qa@company.com).

  • Filter/Exclusion: Exclude clicks originating from specific administrative service accounts or mailboxes designated for QA (e.g., qa-mailbox@company.com) or users belonging to the “IT Admins” or “Security QA” Azure AD security group.

• Scenario: Scheduled automated workflows or integration tests (e.g., using Power Automate or Azure Logic Apps) that process incoming emails and programmatically click or resolve Safe Links URLs as part of a data ingestion or classification pipeline.

  • Filter/Exclusion: Exclude clicks where the workload is “Office” or “M365 Copilot” and the user agent string or client ID corresponds to known automation services (e.g., PowerAutomate, LogicApps) or where the source device name matches the automation server (e.g., auto-worker-01).

• Scenario: End-user training sessions or new-hire onboarding where employees are instructed to click specific “test” links in welcome emails to confirm their Safe Links protection is enabled, often done in bulk during