Suspicious URL in Email with Click Detection

Damien vd Linden@lindensec

•updated Jul 11, 2025•5•3•70

This rule detects emails containing a URL to a suspicious domain. It also checks if any of these suspicious URLs were subsequently clicked by a user, indicating potential compromise or successful phishing.