T1566.002 Spearphishing Link - Rare URL Clicks

Group by: ParentImage, URLHost
Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

Below query analyzes URLs that are opened from applications like Outlook, Word, Excel, Powerpoint, and Adobe PDF apps. It finds rare URLs that might be a phishing attempt.
It is strongly recommended to enrich results with prevalence information using firewall or proxy logs. You can reduce the noise by filtering specific parent processes according to your needs.
You can further improve the results using logic apps or scripting to get extra information about the URL(age, certificate, VT score etc.) Keep in mind that there ways to bypass controls by hosting the phishing links inside a document stored in the cloud. You don't have any visibility with Sysmon in this scenario.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link

Event coverage

Provider	Event	Title
Sysmon	Event ID 1	Process creation

Rule body kusto

// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
// Link to original post:
// https://posts.bluraven.io/hunting-for-phishing-links-using-sysmon-and-kql-e87d1118ce5e
//
//
// Query parameters:
// Define how manys days of data you want to analyze.
// Consider covering weekends
let lookback = 3d;
// Define how many user might receive the same phishing URL(based on URL or URLHost).
let PhishingTargetMax = 5;
// Get all URLs that were clicked
let PotentialPhishingLinks = materialize ( 
    Event
    | where TimeGenerated > ago(lookback)
    | where Source == "Microsoft-Windows-Sysmon" and EventID == 1
    // Get only the relevant events to improve the query performance during parsing
    | where RenderedDescription has_any ("http://", "https://") and RenderedDescription has_any ("msedge.exe", "chrome.exe", "firefox.exe","brave.exe")
    | extend RenderedDescription = tostring(split(RenderedDescription, ":")[0])
    | extend EventData = parse_xml(EventData).DataItem.EventData.Data
    | mv-expand bagexpansion=array EventData
    | evaluate bag_unpack(EventData)
    | extend Key=tostring(['@Name']), Value=['#text']
    | evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, RenderedDescription, MG, ManagementGroupName, Type)
    | extend RuleName = column_ifexists("RuleName", ""), TechniqueId = column_ifexists("TechniqueId", ""),
            TechniqueName = column_ifexists("TechniqueName", ""),
            ParentImage = tostring(ParentImage),
            OriginalFileName = tostring(OriginalFileName),
            CommandLine = tostring(CommandLine),
            Computer = tostring(Computer)
    | parse RuleName with * 'technique_id=' TechniqueId ',' * 'technique_name=' TechniqueName
    // Extract URL and URLHost 
    | extend URL = extract("((http|https):\\/\\/.*)\\s?",1,tostring(CommandLine))
    | extend URLHost = tostring(parse_url(URL).Host)
    )
    ;
// Perform frequency analysis.
// WARNING!!: Phishing URLs can be customized per target user or not. 
// Perform 2 different analysis (one for URL, one for URLHost)
//// Frequency analysis by URLHost  ////
PotentialPhishingLinks
| summarize Prevalence = dcount(Computer) by URLHost, ParentImage
| where Prevalence <= PhishingTargetMax
//// Get event details back. ////
| join kind=inner PotentialPhishingLinks on URLHost
// Filter only the last 1 day of events (if you perform analysis everyday)
| where TimeGenerated > ago(1d)
| project-reorder TimeGenerated, Prevalence, Computer, ParentImage, OriginalFileName , URLHost, URL, CommandLine
//// Frequency analysis by URL (comment out the above 8 lines, uncomment the below 8 lines) ////
// PotentialPhishingLinks
// | summarize Prevalence = dcount(Computer) by URL, ParentImage
// | where Prevalence <= PhishingTargetMax
// //// Get event details back. ////
// | join kind=inner PotentialPhishingLinks on URL
// // Filter only the last 1 day of events (if you perform analysis everyday)
// | where TimeGenerated > ago(1d)
// | project-reorder TimeGenerated, Prevalence, Computer, ParentImage, OriginalFileName, URLHost , URL, CommandLine

Stages and Predicates

Parameters

let lookback = 3d;
let PhishingTargetMax = 5;

The stages below define let PotentialPhishingLinks (the rule's main pipeline source).

Stage 1: `source`

let PotentialPhishingLinks

Stage 2: `source`

Event

Stage 3: `where`

| where TimeGenerated > ago(lookback)

Stage 4: `where`

| where Source == "Microsoft-Windows-Sysmon" and EventID == 1

Stage 5: `where`

| where RenderedDescription has_any ("http://", "https://") and RenderedDescription has_any ("msedge.exe", "chrome.exe", "firefox.exe","brave.exe")

Stage 6: `extend`

| extend RenderedDescription = tostring(split(RenderedDescription, ":")[0])

Stage 7: `extend`

| extend EventData = parse_xml(EventData).DataItem.EventData.Data

Stage 8: `mv-expand`

| mv-expand bagexpansion=array EventData

Stage 9: `evaluate`

| evaluate bag_unpack(EventData)

Stage 10: `extend`

| extend Key=tostring(['@Name']), Value=['#text']

Stage 11: `evaluate`

| evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, RenderedDescription, MG, ManagementGroupName, Type)

Stage 12: `extend`

| extend RuleName = column_ifexists("RuleName", ""), TechniqueId = column_ifexists("TechniqueId", ""),
            TechniqueName = column_ifexists("TechniqueName", ""),
            ParentImage = tostring(ParentImage),
            OriginalFileName = tostring(OriginalFileName),
            CommandLine = tostring(CommandLine),
            Computer = tostring(Computer)

Stage 13: `parse`

| parse RuleName with * 'technique_id=' TechniqueId ',' * 'technique_name=' TechniqueName

Stage 14: `extend`

| extend URL = extract("((http|https):\\/\\/.*)\\s?",1,tostring(CommandLine))

Stage 15: `extend`

| extend URLHost = tostring(parse_url(URL).Host)

The stages below run on PotentialPhishingLinks (the outer pipeline).

Stage 16: `summarize`

PotentialPhishingLinks
| summarize Prevalence = dcount(Computer) by URLHost, ParentImage

Threshold: le 5

Stage 17: `where`

| where Prevalence <= PhishingTargetMax

Stage 18: `join`

| join kind=inner PotentialPhishingLinks on URLHost

Stage 19: `where`

| where TimeGenerated > ago(1d)

Stage 20: `project-reorder`

| project-reorder TimeGenerated, Prevalence, Computer, ParentImage, OriginalFileName , URLHost, URL, CommandLine

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`EventID`	eq	`1` transforms: `cased` corpus 237 (splunk 224, kusto 13)
`Prevalence`	le	`5` transforms: `cased`
`RenderedDescription`	match	`brave.exe` `chrome.exe` `firefox.exe` `http://` `https://` `msedge.exe`

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`ParentImage`	`summarize`
`Prevalence`	`summarize`
`URLHost`	`summarize`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

T1566.002 Spearphishing Link - Rare URL Clicks

MITRE ATT&CK coverage

Event coverage

Rule body kusto

Stages and Predicates

Parameters

Stage 1: `source`

Stage 2: `source`

Stage 3: `where`

Stage 4: `where`

Stage 5: `where`

Stage 6: `extend`

Stage 7: `extend`

Stage 8: `mv-expand`

Stage 9: `evaluate`

Stage 10: `extend`

Stage 11: `evaluate`

Stage 12: `extend`

Stage 13: `parse`

Stage 14: `extend`

Stage 15: `extend`

Stage 16: `summarize`

Stage 17: `where`

Stage 18: `join`

Stage 19: `where`

Stage 20: `project-reorder`

Indicators

Output fields

Keyboard shortcuts

Search operators

T1566.002 Spearphishing Link - Rare URL Clicks

MITRE ATT&CK coverage

Event coverage

Rule body kusto

Stages and Predicates

Parameters

Stage 1: source

Stage 2: source

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend

Stage 7: extend

Stage 8: mv-expand

Stage 9: evaluate

Stage 10: extend

Stage 11: evaluate

Stage 12: extend

Stage 13: parse

Stage 14: extend

Stage 15: extend

Stage 16: summarize

Stage 17: where

Stage 18: join

Stage 19: where

Stage 20: project-reorder

Indicators

Output fields

Stage 1: `source`

Stage 2: `source`

Stage 3: `where`

Stage 4: `where`

Stage 5: `where`

Stage 6: `extend`

Stage 7: `extend`

Stage 8: `mv-expand`

Stage 9: `evaluate`

Stage 10: `extend`

Stage 11: `evaluate`

Stage 12: `extend`

Stage 13: `parse`

Stage 14: `extend`

Stage 15: `extend`

Stage 16: `summarize`

Stage 17: `where`

Stage 18: `join`

Stage 19: `where`

Stage 20: `project-reorder`