URL Click-Through by Workload

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) where users bypass Azure Safe Links protections by clicking through warnings, indicating a potential compromise of workload identities or user sessions. Proactively hunting for these events in Azure Sentinel allows the SOC to identify high-risk click-throughs associated with specific workloads, enabling rapid containment before lateral movement or data exfiltration occurs.

KQL Query

UrlClickEvents
| where Timestamp > ago(30d)
| where IsClickedThrough != "0"
| where isnotempty(ThreatTypes)
| summarize ['Click-Through Count'] = count() by Workload
| sort by ['Click-Through Count'] desc
| render piechart

Analytic Rule Definition

id: f9cc3c34-3424-42c6-878b-9f67808b086f
name: URL Click-Through by Workload
description: |
  This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from.
description-detailed: |
  This query shows Safe Links click-through activity in Microsoft Defender for Office 365 - clicks on URLs carrying a threat where the user chose to proceed past the warning page (IsClickedThrough) - broken down by the workload the click originated from (Email, Teams, Office, Microsoft 365 Copilot).
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents
  | where Timestamp > ago(30d)
  | where IsClickedThrough != "0"
  | where isnotempty(ThreatTypes)
  | summarize ['Click-Through Count'] = count() by Workload
  | sort by ['Click-Through Count'] desc
  | render piechart
version: 1.0.0

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

MITRE ATT&CK Context

Tactic: InitialAccess
Technique: T1566 — T1566

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL Click/URL Click-Through by Workload.yaml)

False Positive Guidance

Automated Reporting and Dashboard Refreshes: Business intelligence tools like Power BI or Tableau often embed external links to data sources or documentation. When these services run scheduled refresh jobs or when users interact with dynamic report elements, the underlying service account (e.g., svc-powerbi or app-tableau) may trigger a click-through event.
- Filter/Exclusion: Exclude workloads where the principal is a known service account (e.g., *svc-*, *app-*) or filter by specific application IDs associated with BI platforms.
CI/CD Pipeline Artifact Verification: In DevOps environments, tools like Azure DevOps or Jenkins may automatically fetch or validate build artifacts, release notes, or dependency links during pipeline execution. If a pipeline step involves clicking a link to verify a checksum or access a raw file on a CDN, the workload identity (e.g., ci-cd-runner, jenkins-agent) will register as the click-through source.
- Filter/Exclusion: Exclude workloads tagged with ci-cd, pipeline, or build-agent in the workload metadata, or filter by specific machine groups used for build agents.
Email-to-Chat Integration Bots: Enterprise chat platforms like Microsoft Teams or Slack often use bot integrations (e.g., Zapier, Power Automate) to post notifications from external services (like Jira, GitHub, or PagerDuty). These bots frequently include clickable links to issues or commits. When the bot processes the message or when the integration service clicks the link to fetch details, the workload identity (e.g., teams-bot, zapier-integration) triggers the detection.
- Filter/Exclusion: Exclude workloads containing keywords like bot, integration, or connector in the name