Message with URL listed on OpenPhish delivered into Inbox

id: d16f57cb-6a39-4e90-ae25-8902c68232ab
name: Message with URL listed on OpenPhish delivered into Inbox
description: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox
description-detailed: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let PhishingURLs = externaldata(url: string)
  [
      "https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt"
  ]
  with (format="txt"); // CSV and JSON formats are also valid formats if using the premium feeds
  EmailUrlInfo
  | where Url in (PhishingURLs)
  | join EmailEvents on NetworkMessageId
  | where LatestDeliveryAction == "Delivered"
version: 1.0.0