PhishingEmailUrlRedirector

Description

This query was originally published on Twitter, by @MsftSecIntel. The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection. Reference - https://twitter.com/MsftSecIntel

Query · kql

EmailUrlInfo
| where Url matches regex @"s?\:\/\/(?:www\.)?t\.(?:[\w\-\.]+\/+)+(?:r|redirect)\/?\?"
Raw source PhishingEmailUrlRedirector · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c73911ab-bcc0-4add-9963-597d2fb74488
name: PhishingEmailUrlRedirector
description: |
  This query was originally published on Twitter, by @MsftSecIntel.
  The query helps detect emails associated with a campaign that has used open redirector URLs. The campaign's URLs begin with the distinct pattern, hxxps://t. Attackers use URL redirection to manipulate users into visiting a malicious website or to evade detection.
  Reference - https://twitter.com/MsftSecIntel
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
tactics:
- Initial access
query: |
  EmailUrlInfo
  | where Url matches regex @"s?\:\/\/(?:www\.)?t\.(?:[\w\-\.]+\/+)+(?:r|redirect)\/?\?"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.