← Back to SOC feed Coverage →

Teams URL clicks through actions on Phish or Malware URLs summarized by URLs

kql MEDIUM Azure-Sentinel
T1566
UrlClickEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-12T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may be using phishing or malware URLs embedded in Teams messages to initiate initial compromise by诱骗 users to click malicious links. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential phishing campaigns and malware distribution attempts early.

KQL Query

//Teams URL clicks through actions on Phish or Malware URLs summarized by URLs
UrlClickEvents 
| where IsClickedThrough !="0" and Workload =="Teams"
| where ThreatTypes in ("Phish","Malware") 
| summarize by Url,ThreatTypes, IsClickedThrough, ActionType

Analytic Rule Definition

id: 8ccb7460-16a4-4cff-9ce7-0eaea2c3d480
name: Teams URL clicks through actions on Phish or Malware URLs summarized by URLs
description: |
  This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls.
description-detailed: |
  This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Teams URL clicks through actions on Phish or Malware URLs summarized by URLs
  UrlClickEvents 
  | where IsClickedThrough !="0" and Workload =="Teams"
  | where ThreatTypes in ("Phish","Malware") 
  | summarize by Url,ThreatTypes, IsClickedThrough, ActionType
version: 1.0.0

Required Data Sources

Sentinel TableNotes
UrlClickEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks through actions on Phish or Malware URLs summarized by URLs.yaml