Top 10 Users clicking on malicious URLs in Teams

Description

This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams.

Query · kql

//Top 10 Users clicking on malicious URLs in Teams
UrlClickEvents 
| where Workload =="Teams" and ThreatTypes in ("Phish","Malware") 
| summarize Blocked = countif(ActionType =="ClickBlocked"), Allowed = countif(ActionType =="ClickAllowed"), PendingVerdict = countif(ActionType =="UrlScanInProgress"), Error = countif(ActionType =="UrlErrorPage"), ClickedThrough = countif(IsClickedThrough)by AccountUpn
| top 10 by Blocked desc
Raw source Top 10 Users clicking on malicious URLs in Teams · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2186afac-1cde-441d-9825-0dbfd5f59d05
name: Top 10 Users clicking on malicious URLs in Teams
description: |
  This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams.
description-detailed: |
  This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Top 10 Users clicking on malicious URLs in Teams
  UrlClickEvents 
  | where Workload =="Teams" and ThreatTypes in ("Phish","Malware") 
  | summarize Blocked = countif(ActionType =="ClickBlocked"), Allowed = countif(ActionType =="ClickAllowed"), PendingVerdict = countif(ActionType =="UrlScanInProgress"), Error = countif(ActionType =="UrlErrorPage"), ClickedThrough = countif(IsClickedThrough)by AccountUpn
  | top 10 by Blocked desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.