Microsoft Defender for Office 365 Malicious URL Click Campaign Aggregation

DL Cyber@DanCortex

•updated Aug 24, 2026•3•0•11

This rule correlates Microsoft Defender for Office 365 'Safe Links' phishing alerts, which indicate a user has clicked a potentially malicious URL. It extracts the malicious domain from the URL and aggregates multiple alert events by that domain to identify potential phishing campaigns impacting multiple users within the organization.