KQL - Bulk URL Campaign Infrastructure Analysis
Identifies inbound email campaigns that deliver URLs to large numbers of recipients and groups activity by parent domain. The query helps analysts uncover domains using multiple subdomains and sender identities to distribute URL-based campaigns. It also measures overall email volume, unique sending infrastructure, recipient reach, and campaign frequency for each parent domain. This is useful for: Phishing campaign analysis Infrastructure clustering Bulk sender investigations Threat hunting Domain reputation reviews Email security tuning
Microsoft Sentinel (KQL)
