Delivered Inbound Phishing Emails with Malicious URLs
This rule identifies inbound emails that have been delivered to the organization's email domain and are categorized as 'Phishing' by the email security system. It specifically looks for phishing indicators within the email's attachment or body. The query then summarizes the count of such emails by their URL domain, sorting them to highlight the most frequent phishing domains. The accompanying Python script demonstrates how to cross-reference these identified URL domains with VirusTotal for further analysis.
Microsoft Sentinel (KQL)
