URL click on ZAP email

Description

In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge

Query · kql

AlertInfo
| where Title contains "Email messages containing malicious URL removed after delivery" and Timestamp > ago (7d)
| join kind=inner (AlertEvidence| where EntityType == "MailMessage") on AlertId 
| join UrlClickEvents on NetworkMessageId
Raw source URL click on ZAP email · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: efe27064-6d35-4720-b7f5-e0326695613d
name: URL click on ZAP email
description: |
  In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge
description-detailed: |
  In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge (ZAP) in Defender for Office 365.
  Reference - https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
   - UrlClickEvents
   - Alertinfo
   - AlertEvidence
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  AlertInfo
  | where Title contains "Email messages containing malicious URL removed after delivery" and Timestamp > ago (7d)
  | join kind=inner (AlertEvidence| where EntityType == "MailMessage") on AlertId 
  | join UrlClickEvents on NetworkMessageId
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.