SuspiciousUrlClicked

Description

Identify emails that were send from an address external to your company and where email was send to more then 50 distinct corporate users. Update corporatedomain.com to your corporate domain to have it excluded. Update 50 if you want to adjust the distinct user count.

Query · kql

EmailEvents 
| where SenderFromDomain != "corporatedomain.com" 
| summarize dcount(RecipientEmailAddress) by SenderFromAddress, NetworkMessageId, AttachmentCount, SendTime = Timestamp 
| where dcount_RecipientEmailAddress > 50
Raw source SuspiciousUrlClicked · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 50835f49-7e5b-4852-a05a-f5aab2f40dd1
name: SuspiciousUrlClicked
description: |
  Identify emails that were send from an address external to your company and where email was send to more then 50 distinct corporate users.
  Update corporatedomain.com to your corporate domain to have it excluded.
  Update 50 if you want to adjust the distinct user count.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
- Initial access
query: |
  EmailEvents 
  | where SenderFromDomain != "corporatedomain.com" 
  | summarize dcount(RecipientEmailAddress) by SenderFromAddress, NetworkMessageId, AttachmentCount, SendTime = Timestamp 
  | where dcount_RecipientEmailAddress > 50

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.