Top malicious URLs clicked by users in Teams

Description

This query helps hunt for top malicious URLs clicked by users in Teams

Query · kql

//This query shows the top 20 URL's that have a detection associated with it and the most ammount of clicks registered from Microsoft Teams 
UrlClickEvents
| where ThreatTypes !="" and Workload =="Teams"
| summarize count() by Url, ThreatTypes, ActionType, Workload
| project Url, ThreatTypes, ActionType, Workload, ClickCount=count_
| top 20 by ClickCount
Raw source Top malicious URLs clicked by users in Teams · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1676c486-4f27-4c88-b36f-6110a182d6de
name: Top malicious URLs clicked by users in Teams
description: |
  This query helps hunt for top malicious URLs clicked by users in Teams  
description-detailed: |
  This query helps hunt for top malicious URLs clicked by users in Teams using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query shows the top 20 URL's that have a detection associated with it and the most ammount of clicks registered from Microsoft Teams 
  UrlClickEvents
  | where ThreatTypes !="" and Workload =="Teams"
  | summarize count() by Url, ThreatTypes, ActionType, Workload
  | project Url, ThreatTypes, ActionType, Workload, ClickCount=count_
  | top 20 by ClickCount
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.