URL Threat Protection Summary

Hunt Hypothesis

This hypothesis targets phishing campaigns (T1566) where adversaries use malicious URLs to compromise users, detected through anomalies in Safe Links click outcomes and distinct URL volumes in email traffic. Proactively hunting for these metrics in Azure Sentinel allows the SOC to identify emerging phishing trends or targeted attacks before they result in successful credential theft or malware execution.

KQL Query

let clicks = UrlClickEvents | where Timestamp > ago(30d);
union
(clicks | where ActionType in ("ClickBlocked","ClickBlockedByTenantPolicy") | summarize Count = count() | extend Details = "Malicious Clicks Blocked", Ord = 1),
(clicks | where ActionType == "ClickAllowed" | summarize Count = count() | extend Details = "Clicks Allowed Through", Ord = 2),
(clicks | summarize Count = dcount(AccountUpn) | extend Details = "Users Clicking Links", Ord = 3),
(EmailUrlInfo | where Timestamp > ago(30d) | summarize Count = dcount(Url) | extend Details = "Distinct URLs in Email", Ord = 4)
| sort by Ord asc
| project Count, Details

Analytic Rule Definition

id: 074959c6-2e9d-4f11-b9c8-971b7387aa99
name: URL Threat Protection Summary
description: |
  This query summarises URL threat protection activity (Safe Links click outcomes and distinct URLs seen in email) as a set of headline metrics for the selected period.
description-detailed: |
  This query summarises URL threat protection activity in Microsoft Defender for Office 365 as headline metrics: malicious clicks blocked, clicks allowed through, distinct users clicking links (from UrlClickEvents), and distinct URLs seen in email (from EmailUrlInfo).
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let clicks = UrlClickEvents | where Timestamp > ago(30d);
  union
  (clicks | where ActionType in ("ClickBlocked","ClickBlockedByTenantPolicy") | summarize Count = count() | extend Details = "Malicious Clicks Blocked", Ord = 1),
  (clicks | where ActionType == "ClickAllowed" | summarize Count = count() | extend Details = "Clicks Allowed Through", Ord = 2),
  (clicks | summarize Count = dcount(AccountUpn) | extend Details = "Users Clicking Links", Ord = 3),
  (EmailUrlInfo | where Timestamp > ago(30d) | summarize Count = dcount(Url) | extend Details = "Distinct URLs in Email", Ord = 4)
  | sort by Ord asc
  | project Count, Details
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL Click/URL Threat Protection Summary.yaml)

False Positive Guidance

• Scenario: High-volume automated email campaigns (e.g., marketing newsletters or internal HR announcements) where the same URL is clicked by hundreds of users within a short window, causing the “distinct URLs seen” metric to spike artificially due to repeated clicks on identical links.
  • Filter/Exclusion: Exclude URLs associated with known marketing domains (e.g., mailchimp.com, hubspot.net) or filter out clicks from service accounts and distribution groups (e.g., *@marketing.internal, hr-announcements@corp.com) to isolate unique human-initiated traffic.
• Scenario: Scheduled PowerShell or Python scripts running on mail servers or gateways that programmatically fetch or validate URLs in incoming emails for security scanning, generating a high count of “Safe Links click outcomes” or distinct URL checks that are not user-initiated.
  • Filter/Exclusion: Exclude activity from specific service accounts (e.g., svc-url-scanner, admin-gateway) or filter by user agent strings containing PowerShell, Python-urllib, or curl if the telemetry source captures client metadata, to distinguish automated validation from user interaction.
• Scenario: End-user testing of new email templates or onboarding kits where IT staff or pilot users repeatedly click various URLs in test emails to verify rendering and link behavior, creating a burst of distinct URL activity that mimics a potential phishing campaign.
  • Filter/Exclusion: Exclude clicks from specific test accounts (e.g., it-test-user01, qa-team@corp.com) or apply a time-based exclusion during known maintenance windows (e.g., 2024-05-15 02:00:00Z to 2024-05-15 04:00:00Z) when template testing is scheduled.