← Back to SOC feed Coverage →

QR Code URL Detections Trend

kql MEDIUM Azure-Sentinel
T1566
EmailEventsEmailUrlInfo
huntingmicrosoftofficialphishing
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-04T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries are increasingly leveraging QR codes in inbound emails to bypass traditional URL filtering and direct users to malicious landing pages, aligning with the Phishing technique (T1566). Proactively hunting for this trend in Azure Sentinel allows the SOC to identify emerging phishing campaigns that exploit visual obfuscation before they result in credential theft or malware execution.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let qrMessages = EmailUrlInfo
| where Timestamp >= TimeStart
| where UrlLocation == "QRCode"
| distinct NetworkMessageId;
EmailEvents
| where Timestamp >= TimeStart
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| where EmailDirection == "Inbound" and DetectionMethods has "Url"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where NetworkMessageId in (qrMessages)
| make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has "URL"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has "URL"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has "URL") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart

Analytic Rule Definition

id: aa121105-95a2-4424-84d7-1c5c47e5d44b
name: QR Code URL Detections Trend
description: |
  This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam).
description-detailed: |
  This query visualises inbound email detections in Microsoft Defender for Office 365 where the malicious URL was embedded in a QR code (EmailUrlInfo UrlLocation == "QRCode"), over time and split by whether the URL was flagged for phishing, malware or spam. Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let qrMessages = EmailUrlInfo
  | where Timestamp >= TimeStart
  | where UrlLocation == "QRCode"
  | distinct NetworkMessageId;
  EmailEvents
  | where Timestamp >= TimeStart
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | where EmailDirection == "Inbound" and DetectionMethods has "Url"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where NetworkMessageId in (qrMessages)
  | make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has "URL"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has "URL"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has "URL") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled
EmailUrlInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL/QR Code URL Detections Trend.yaml