KQL - Bulk Phishing Campaign Triage with Click and Remediation Signals
Identifies suspicious inbound bulk email campaigns by correlating sender behaviour, recipient spread, URL evidence, Safe Links click telemetry, external SharePoint links, post-delivery remediation actions, and campaign delivery outcomes. The query is designed to help analysts prioritise campaigns that may require investigation or remediation by scoring indicators such as freemail sender domains, multiple recipients, rotating sender infrastructure, personalised subject lines, external SharePoint usage, allowed clicks, blocked clicks, ZAP actions, manual remediation, and failed post-delivery actions. It is especially useful for phishing triage, campaign scoping, post-delivery investigation, and identifying threats that reached user inboxes or received user interaction. Microsoft documents EmailEvents as containing email processing events in Defender for Office 365, UrlClickEvents as containing Safe Links click information, and EmailPostDeliveryEvents as containing post-delivery email actions such as remediation activity.
Microsoft Sentinel (KQL)
