Top 20 Malicious URLs by Clicks

Hunt Hypothesis

This hypothesis targets phishing campaigns (T1566) where adversaries rely on high user engagement to execute malicious payloads, as indicated by a significant volume of clicks on URLs flagged by threat intelligence. Proactively hunting for these high-click URLs in Azure Sentinel allows the SOC to identify compromised endpoints or targeted users before lateral movement occurs, reducing the mean time to containment for widespread phishing incidents.

KQL Query

UrlClickEvents
| where Timestamp > ago(30d)
| where ThreatTypes != ""
| summarize ['Click Count'] = count() by Url, ThreatTypes, ActionType, Workload
| top 20 by ['Click Count']
| project ['URL'] = Url, ['Threat Types'] = ThreatTypes, ['Action Type'] = ActionType, Workload, ['Click Count']

Analytic Rule Definition

id: 188a0e9a-d775-4ad2-b7a0-64df26c0b931
name: Top 20 Malicious URLs by Clicks
description: |
  This query lists the top 20 URLs carrying a detection ranked by the number of clicks registered, with the threat type, click action and workload for each.
description-detailed: |
  This query lists the top 20 URLs with an associated threat detection in Microsoft Defender for Office 365, ranked by the number of Safe Links clicks registered, and shows the threat type, click action (blocked, allowed, and so on) and the workload the clicks came from - a forensic view of the most-clicked malicious URLs.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents
  | where Timestamp > ago(30d)
  | where ThreatTypes != ""
  | summarize ['Click Count'] = count() by Url, ThreatTypes, ActionType, Workload
  | top 20 by ['Click Count']
  | project ['URL'] = Url, ['Threat Types'] = ThreatTypes, ['Action Type'] = ActionType, Workload, ['Click Count']
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL Click/Top 20 Malicious URLs by Clicks.yaml)

False Positive Guidance

• Scenario: A marketing team uses a URL shortening service (e.g., Bitly or TinyURL) for a major product launch campaign, where the shortened link is embedded in thousands of email signatures and landing pages. The detection engine may flag the shortener domain as “malicious” due to historical abuse or heuristic scoring, resulting in a high click count from legitimate users.

  • Filter/Exclusion: Exclude URLs where the domain matches known internal shortening services (e.g., bit.ly, tinyurl.com) if they are whitelisted in the corporate proxy, or filter out clicks originating from the “Marketing” or “Sales” workload groups during active campaign windows.

• Scenario: The IT Operations team performs a scheduled maintenance window where they distribute a temporary diagnostic script or update package via a shared internal web server (e.g., http://internal-tools.corp.local/update-v2.1.html). If this internal IP or hostname is occasionally resolved to a public IP due to DNS misconfiguration or if the URL is accessed via a public-facing CDN for external contractors, it may be flagged as a suspicious URL with high click volume from admin accounts.

  • Filter/Exclusion: Exclude URLs containing internal domain suffixes (e.g., .corp.local, .internal) or specific known maintenance paths (e.g., /update/, /diag/) when the click action is associated with the “IT_Ops” or “Admin” workload.

• Scenario: A new SaaS application (e.g., Slack, Zoom, or Jira) is rolled out to the organization, and the initial login or onboarding flow uses a deep-link URL that is heavily clicked by users during the first week of adoption. The detection rule may interpret the high frequency of clicks on this specific URL as a potential phishing or drive-by download attack, especially if the URL contains query parameters that look like tokens.