← Back to SOC feed Coverage →

Malware URL Detections Trend

kql MEDIUM Azure-Sentinel
T1566
EmailEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-04T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) that embed malicious URLs in inbound emails to deliver malware, a common initial access vector for threat actors. Proactively hunting for trends in these URL-based detections allows the SOC to identify emerging phishing waves or specific threat actor campaigns before they result in widespread compromise within the Azure environment.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailEvents
| where Timestamp >= TimeStart
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where DetectionMethods has "Malware"
| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)
| where MalwareMethod contains "URL"
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod
| render timechart

Analytic Rule Definition

id: 7a25af1f-c757-490e-909d-f803b94ed8d2
name: Malware URL Detections Trend
description: |
  This query visualises inbound email malware detections attributed to URL-based detection technologies over time.
description-detailed: |
  This query visualises inbound email malware detections in Microsoft Defender for Office 365 over time, limited to URL-based malware detection technologies (for example URL detonation). Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents
  | where Timestamp >= TimeStart
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where DetectionMethods has "Malware"
  | mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)
  | where MalwareMethod contains "URL"
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod
  | render timechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL/Malware URL Detections Trend.yaml