Top 10 URL domains attacking organization

Description

This query helps reviewing list of top 10 URL domains attacking the organization

Query · kql

EmailEvents 
| where ThreatTypes != "" 
| extend detection= parse_json(DetectionMethods) 
| extend Spam = tostring(detection.Spam) 
| extend Phish = tostring(detection.Phish) 
| where (Spam == '["URL malicious reputation"]') or (Phish == '["URL malicious reputation"]') or (Phish == '["URL detonation reputation"]') or (Phish == '["URL detonation"]') 
| join EmailUrlInfo on NetworkMessageId
| summarize total=count() by UrlDomain 
| top 10 by total 
| render columnchart
Raw source Top 10 URL domains attacking organization · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 27ee28e7-423b-48c9-a410-cbc6c8e21d25
name: Top 10 URL domains attacking organization
description: |
  This query helps reviewing list of top 10 URL domains attacking the organization
description-detailed: |
  This query helps reviewing list of top 10 URL domains attacking the organization using Defender for Office 365 data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where ThreatTypes != "" 
  | extend detection= parse_json(DetectionMethods) 
  | extend Spam = tostring(detection.Spam) 
  | extend Phish = tostring(detection.Phish) 
  | where (Spam == '["URL malicious reputation"]') or (Phish == '["URL malicious reputation"]') or (Phish == '["URL detonation reputation"]') or (Phish == '["URL detonation"]') 
  | join EmailUrlInfo on NetworkMessageId
  | summarize total=count() by UrlDomain 
  | top 10 by total 
  | render columnchart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.