Use of URL Shortener in Email – Potential Phishing Indicator
This detection identifies emails containing links that use well-known URL shortening services (e.g., bit.ly, t.co, tinyurl.com). While these services are commonly used for legitimate purposes, they are frequently abused by threat actors to obfuscate malicious destinations. This detection joins EmailUrlInfo with EmailEvents to include sender metadata and filters out trusted senders based on a configurable watchlist (ShortenerSafeSenders).
Microsoft Sentinel (KQL)
