Email Link Clicked Following Post-Delivery Email Deletion
This rule detects scenarios where an email containing a specific URL has been soft or hard deleted from a user's mailbox (often by security automated systems), but a user has subsequently clicked that same URL. This often indicates a race condition or a failure in security controls where a malicious link was delivered and accessed before or during the removal process.
Microsoft Sentinel (KQL)
