URLs by location

Hunt Hypothesis

Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk. Based on Defender for Office 36

KQL Query

EmailUrlInfo
| summarize Count = count() by UrlLocation
| render piechart

Analytic Rule Definition

id: ab006655-d723-4844-9d5d-91cb3b020555
name: URLs by location
description: |
  Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.
  Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailUrlInfo
  | summarize Count = count() by UrlLocation
  | render piechart
version: 1.0.0

Required Data Sources

False Positive Guidance

• **Scenario: Automated report generation via Power

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/URL/URLs by location.yaml)