id: 08aff8c6-b983-43a3-be95-68a10c3d35e6
name: PhishingEmailUrlRedirector (1)
description: |
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
description-detailed: |
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. The campaign's URLs begin with the distinct pattern, hxxps://t[.]domain[.]tld/r/?. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
This query was originally published on Twitter, by @MsftSecIntel.
Reference - https://twitter.com/MsftSecIntel
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailUrlInfo
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
EmailUrlInfo
//This regex identifies emails containing the "T-Dot" redirector pattern in the URL
| where Url matches regex @"s?\:\/\/(?:www\.)?t\.(?:[\w\-\.]+\/+)+(?:r|redirect)\/?\?"
//This regex narrows in on emails that contain the known malicious domain pattern in the URL from the most recent campaigns
and Url matches regex @"[a-zA-Z]\-[a-zA-Z]{2}\.(xyz|club|shop)"
version: 1.0.0