High-Confidence Phishing Emails Delivered
Detects high-confidence phishing emails that were successfully delivered to user inboxes or folders instead of being quarantined, where the message is identified as first contact and not explicitly allowed through user-level safe sender/domain overrides. The query enriches the email data with URL click telemetry from UrlClickEvents, allowing visibility into whether embedded URLs were clicked or not clicked, who clicked them, and when the click occurred. This detection is intended to identify potentially malicious phishing emails that bypassed preventive controls and provide recipient-level click insight to support triage, impact assessment, and response actions.
Microsoft Sentinel (KQL)
