URL Click-Through by Workload

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from.

Attribute	Value
Type	Hunting Query
Solution	Microsoft Defender XDR
ID	07e1f2f5-3662-4e8b-8f52-5273d220976b
Tactics	InitialAccess
Techniques	T1566
Required Connectors	MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
UrlClickEvents	IsClickedThrough != "0"	✓	✗	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Microsoft Defender XDR