User Clicked on Known Phishing URL
This rule identifies users who have clicked on specific URLs that are known to be associated with phishing attempts. It correlates email URL information with URL click events to pinpoint users who interacted with malicious links shared via email. This is particularly useful for identifying victims of targeted phishing campaigns.
Microsoft Sentinel (KQL)
