User Clicked Through Email URL Warning
This detection identifies instances where a user has clicked on a URL within an email and has actively bypassed a security warning page. This behavior is a strong indicator of a successful phishing lure or high-risk user action, as the user has ignored a direct warning about the potential danger of the destination link.
Microsoft Sentinel (KQL)
