User clicks on phishing URLs in emails

Description

This query helps in determining clickthroughs when email delivered because of detection overrides.

Query · kql

UrlClickEvents 
| where ThreatTypes has "Phish" 
| join EmailEvents on NetworkMessageId,  $left.AccountUpn == $right.RecipientEmailAddress 
| project Timestamp, Url, ActionType, AccountUpn, ReportId, NetworkMessageId, ThreatTypes, IsClickedThrough, DeliveryLocation, OrgLevelAction, UserLevelAction
Raw source User clicks on phishing URLs in emails · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d823da0e-1334-4a66-8ff4-2c2c40d26295
name: User clicks on phishing URLs in emails
description: |
  This query helps in determining clickthroughs when email delivered because of detection overrides.
description-detailed: |
  This query helps in determining clickthroughs, potential deliveries through User/Tenant overrides and detection details for malicious clicks on URLs in emails
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents 
  | where ThreatTypes has "Phish" 
  | join EmailEvents on NetworkMessageId,  $left.AccountUpn == $right.RecipientEmailAddress 
  | project Timestamp, Url, ActionType, AccountUpn, ReportId, NetworkMessageId, ThreatTypes, IsClickedThrough, DeliveryLocation, OrgLevelAction, UserLevelAction
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.