Phishing URL Detections Trend

Hunt Hypothesis

This hypothesis targets adversary exploitation of T1566 (Phishing) by identifying inbound emails where URL-based detection engines flag malicious links, a common vector for initial access. Proactively hunting for these detections in Azure Sentinel allows the SOC to correlate emerging phishing trends with user engagement, enabling rapid isolation of compromised accounts before attackers leverage valid credentials for lateral movement.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailEvents
| where Timestamp >= TimeStart
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where DetectionMethods has "Phish"
| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)
| where PhishMethod contains "URL"
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod
| render timechart

Analytic Rule Definition

id: 53278c60-3354-4452-a032-d2e239bed34b
name: Phishing URL Detections Trend
description: |
  This query visualises inbound email phishing detections attributed to URL-based detection technologies over time.
description-detailed: |
  This query visualises inbound email phishing detections in Microsoft Defender for Office 365 over time, limited to URL-based phishing detection technologies (for example URL detonation, URL malicious reputation). Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents
  | where Timestamp >= TimeStart
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where DetectionMethods has "Phish"
  | mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)
  | where PhishMethod contains "URL"
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod
  | render timechart
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL/Phishing URL Detections Trend.yaml)

False Positive Guidance

• Scenario: Automated service account emails (e.g., from monitoring@internal-tools.com) containing dynamic status links to internal dashboards (e.g., https://grafana.internal/d/abc123) are flagged because the URL shortener or redirector used by the dashboard tool is on a shared threat intelligence blocklist for known phishing infrastructure.
  • Filter/Exclusion: Exclude inbound emails where the sender is a verified internal service account (e.g., *@service-accounts.corp) AND the URL domain matches the internal Grafana or monitoring namespace (*.grafana.internal), or specifically whitelist the redirector service used by the monitoring stack (e.g., bit.ly if used internally, though rare).
• Scenario: IT Helpdesk or HR departments sending mass communications with links to internal knowledge base articles (e.g., https://kb.corp/article/12345) that use a URL shortening service (like tinyurl.com or bit.ly) for cleaner display, which is frequently seen in phishing campaigns.
  • Filter/Exclusion: Exclude emails where the sender domain is a known internal support domain (e.g., helpdesk@corp, hr@corp) AND the URL resolves to an internal IP range or internal DNS suffix (*.corp, *.internal), or whitelist specific shorteners used by approved internal tools (e.g., tinyurl.com if verified as corporate use).
• Scenario: Scheduled job notifications from CI/CD pipelines (e.g., Jenkins, Azure DevOps) sent to developer distribution lists, containing links to build artifacts or logs (e.g., https://jenkins.corp/job/build-12345/) that are hosted on a public-facing CDN or temporary storage bucket (e.g., s3.amazonaws.com/corp-builds/...) which may have a