User clicks on malicious inbound emails

id: 891f4865-75e5-4d40-bc24-ebf97da3ca9a
name: User clicks on malicious inbound emails
description: |
  This query provides insights on users who clicked on a suspicious URL
description-detailed: |
  This query provides insights on users who clicked on a suspicious URL from phishing/malware-categorized inbound emails over the past 30 days using Defender for Office 365 Data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let UrlClicked = (UrlClickEvents
  | where ActionType == "ClickAllowed" or IsClickedThrough !="0"
  | extend Device_IPv4 = IPAddress
  | project ActionType, Device_IPv4, Url, UrlChain, IPAddress, NetworkMessageId);
  EmailEvents
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes) and EmailDirection == "Inbound"
  | where ThreatTypes has_any ("Malware", "Phish")
  | extend SenderFromAddress_IPv4 = strcat(SenderFromAddress, ", ", SenderIPv4)
  | join kind = inner UrlClicked on NetworkMessageId
  | project Timestamp,NetworkMessageId, Subject, SenderFromAddress_IPv4, RecipientEmailAddress, ThreatTypes, ActionType, Url, UrlChain, Device_IPv4, LatestDeliveryLocation, LatestDeliveryAction, EmailAction, EmailActionPolicy
version: 1.0.0