← Back to SOC feed Coverage →

PhishingEmailUrlRedirector (1)

kql MEDIUM Azure-Sentinel
T1566
EmailUrlInfo
huntingmicrosoftofficialphishing
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-19T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use phishing emails with malicious URL redirects to compromise user credentials or deploy malware. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential credential theft and lateral movement attempts.

KQL Query

EmailUrlInfo
//This regex identifies emails containing the "T-Dot" redirector pattern in the URL
| where Url matches regex @"s?\:\/\/(?:www\.)?t\.(?:[\w\-\.]+\/+)+(?:r|redirect)\/?\?" 
    //This regex narrows in on emails that contain the known malicious domain pattern in the URL from the most recent campaigns
    and Url matches regex @"[a-zA-Z]\-[a-zA-Z]{2}\.(xyz|club|shop)"

Analytic Rule Definition

id: 08aff8c6-b983-43a3-be95-68a10c3d35e6
name: PhishingEmailUrlRedirector (1)
description: |
  The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
description-detailed: |
  The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. The campaign's URLs begin with the distinct pattern, hxxps://t[.]domain[.]tld/r/?. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
  This query was originally published on Twitter, by @MsftSecIntel.
  Reference - https://twitter.com/MsftSecIntel 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailUrlInfo
  //This regex identifies emails containing the "T-Dot" redirector pattern in the URL
  | where Url matches regex @"s?\:\/\/(?:www\.)?t\.(?:[\w\-\.]+\/+)+(?:r|redirect)\/?\?" 
      //This regex narrows in on emails that contain the known malicious domain pattern in the URL from the most recent campaigns
      and Url matches regex @"[a-zA-Z]\-[a-zA-Z]{2}\.(xyz|club|shop)"
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailUrlInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL/Phishing Email Url Redirector.yaml