Top Clicks on Malicious URLs

Hunt Hypothesis

This hypothesis targets phishing campaigns where adversaries exploit human error by luring users into clicking malicious links, a primary initial access vector defined by MITRE T1566. Proactively hunting for high-frequency clicks on known malicious URLs allows the SOC to identify compromised workloads and users before lateral movement occurs, enabling rapid isolation and remediation within the Azure Sentinel environment.

KQL Query

// Top 20 malicious URLs by click count, with threat type, click action and workload for context.
UrlClickEvents
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
| summarize ClickCount = count() by Url, ThreatTypes, ActionType, Workload
| top 20 by ClickCount
| project Url, ThreatTypes, ActionType, Workload, ClickCount

Analytic Rule Definition

id: b47707bf-1155-4d75-864f-079343f7cf7f
name: Top Clicks on Malicious URLs
description: |
  This query lists the malicious URLs that registered the most user clicks, with threat type, click action and workload, using the UrlClickEvents table.
description-detailed: |
  Ranking the specific URLs (not just the users) that attract the most clicks highlights the malicious links most effectively reaching users, and where the clicks happen (Outlook, Microsoft Teams, Microsoft 365 Copilot, Office apps). This query lists the top URLs associated with a detection by click count, with the threat type, click action and workload for context.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Top 20 malicious URLs by click count, with threat type, click action and workload for context.
  UrlClickEvents
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | summarize ClickCount = count() by Url, ThreatTypes, ActionType, Workload
  | top 20 by ClickCount
  | project Url, ThreatTypes, ActionType, Workload, ClickCount
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL Click/Top Clicks on Malicious URLs.yaml)

False Positive Guidance

• Phishing Simulation Campaigns: Security teams often conduct internal phishing simulations using tools like GoPhish or KnowBe4, where benign but suspicious-looking URLs (e.g., https://sim-portal.corp.local/login) are clicked by users to test awareness. These URLs may be flagged as “malicious” in threat intelligence feeds if the domain is newly registered or has a low reputation score, triggering the rule.
  • Filter/Exclusion: Exclude URLs containing known simulation subdomains (e.g., sim-, phish-, test-) or filter by Workload if the simulation tool is tagged as a specific workload (e.g., PhishingSim).
• Internal DevOps/CI-CD Dashboard Links: Developers and operations engineers frequently click on deep links to internal dashboards or artifact repositories (e.g., Jenkins, GitLab, Azure DevOps) that are hosted on internal IPs or private domains. If these internal domains are not fully trusted in the threat intelligence feed or if the URL contains query parameters that resemble malicious patterns (e.g., ?token=abc123&session=xyz), they may be misclassified.
  • Filter/Exclusion: Exclude URLs where the UrlDomain matches internal corporate domains (e.g., *.corp.local, *.internal, *.intranet) or filter by ClickAction if the click originates from a known application context (e.g., Browser vs. EmailClient).
• Scheduled Report Distribution via Email: Business intelligence tools like Power BI or Tableau often send scheduled email reports to stakeholders containing links to live dashboards. These links may use dynamic tokens or long query strings (e.g., `https://app.powerbi.com/groups/…/reportId/…?accessType=embedded&token=…