TI Map URL Entity to UrlClickEvents

Severity: medium
Time window: 14d
Group by: Id, ObservableValue, ReportId, TI_Url, Url, UrlChain
Source: github.com/Azure/Azure-Sentinel

This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071` Application Layer Protocol

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`UrlClickEvents` action `any`: URL click activity

Rule body

id: ad4fa1f2-2189-459c-9458-f77d2039d2f5
name: TI Map URL Entity to UrlClickEvents
description: |
  'This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.'
severity: Medium
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
  - connectorId: ThreatIntelligence
    dataTypes:
      - ThreatIntelIndicators
  - connectorId: ThreatIntelligenceTaxii
    dataTypes:
      - ThreatIntelIndicators
  - connectorId: MicrosoftDefenderThreatIntelligence
    dataTypes:
      - ThreatIntelIndicators
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let UrlClickEvents_ = materialize(UrlClickEvents
      | where TimeGenerated >= ago(dt_lookBack)
      | extend UrlClickEvents_TimeGenerated = TimeGenerated);
  let ChainReportID = UrlClickEvents_
      | mv-expand todynamic(UrlChain)
      | extend UrlChain = tolower(UrlChain)
      | project ReportId, Url, UrlChain;
  // Url is not always in UrlChain, so we need to check both
  let ClickedUrls = 
    (union isfuzzy=false (ChainReportID), (ChainReportID | project Url = UrlChain))
    | distinct Url
    | summarize make_list(Url);
  let TI = materialize(ThreatIntelIndicators
  //extract key part of kv pair
  | extend IndicatorType = replace(@"\[|\]|\""", "", tostring(split(ObservableKey, ":", 0)))
  | where IndicatorType == "url"
  | extend Url = ObservableValue
    | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
    | where TimeGenerated >= ago(ioc_lookBack)
    | where tolower(Url) in (ClickedUrls)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
    | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
    | project-rename TI_Url = Url, TI_Type = Type
    );
  (union isfuzzy=false (TI | join kind=innerunique (ChainReportID) on $left.TI_Url == $right.UrlChain),
    (TI | join kind=innerunique (ChainReportID) on $left.TI_Url == $right.Url))
  | project-away UrlChain
  | join kind=innerunique (UrlClickEvents_) on ReportId
  | where UrlClickEvents_TimeGenerated < ValidUntil
  | summarize UrlClickEvents_TimeGenerated = arg_max(UrlClickEvents_TimeGenerated, *) by Id
  | extend Description = tostring(parse_json(Data).description)
  | extend ActivityGroupNames = extract(@"ActivityGroup:(\S+)", 1, tostring(parse_json(Data).labels))
  | project UrlClickEvents_TimeGenerated, AccountUpn, Description, ActivityGroupNames, Id, Type, ValidUntil, Confidence, Url, NetworkMessageId
  | extend timestamp = UrlClickEvents_TimeGenerated
  | extend timestamp = UrlClickEvents_TimeGenerated, Name = tostring(split(AccountUpn, '@', 0)), UPNSuffix = tostring(split(AccountUpn, '@', 1))
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountUpn
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
version: 1.0.5
kind: Scheduled

Stages and Predicates

Stage 0: `let`

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let UrlClickEvents_ = materialize(UrlClickEvents
    | where TimeGenerated >= ago(dt_lookBack)
    | extend UrlClickEvents_TimeGenerated = TimeGenerated);
let ChainReportID = UrlClickEvents_
    | mv-expand todynamic(UrlChain)
    | extend UrlChain = tolower(UrlChain)
    | project ReportId, Url, UrlChain;
let ClickedUrls = 
  (union isfuzzy=false (ChainReportID), (ChainReportID | project Url = UrlChain))
  | distinct Url
  | summarize make_list(Url);
let TI = materialize(<inlined as stages below>);

Stage 1: `source`

let UrlClickEvents_

Stage 2: `source`

let ChainReportID

Stage 3: `source`

let ClickedUrls

Stage 4: `union`

union of 2 branches

Stage 5: `source`

ThreatIntelIndicators

Stage 6: `extend`

extend IndicatorType

Stage 7: `where`

where IndicatorType =~ "url"

Stage 8: `extend`

extend Url

Stage 9: `extend`

extend TrafficLightProtocolLevel

Stage 10: `where`

where TimeGenerated >= ago(1209600s)

Stage 11: `where`

where Url =~ "ClickedUrls"

Stage 12: `summarize`

summarize LatestIndicatorTime by Id, ObservableValue

Stage 13: `where`

where (isempty(ValidUntil) or ValidUntil > now())

Stage 14: `project-rename`

project-rename

Stage 15: `join`

join kind=innerunique (ChainReportID) on TI_Url, UrlChain

Stage 16: `source`

ThreatIntelIndicators

Stage 17: `extend`

extend IndicatorType

Stage 18: `where`

where IndicatorType =~ "url"

Stage 19: `extend`

extend Url

Stage 20: `extend`

extend TrafficLightProtocolLevel

Stage 21: `where`

where TimeGenerated >= ago(1209600s)

Stage 22: `where`

where Url =~ "ClickedUrls"

Stage 23: `summarize`

summarize LatestIndicatorTime by Id, ObservableValue

Stage 24: `where`

where (isempty(ValidUntil) or ValidUntil > now())

Stage 25: `project-rename`

project-rename

Stage 26: `join`

join kind=innerunique (ChainReportID) on TI_Url, Url

Stage 27: `project-away`

project-away UrlChain

Stage 28: `join`

join kind=innerunique (UrlClickEvents_) on ReportId

Stage 29: `where`

where UrlClickEvents_TimeGenerated < ValidUntil

Stage 30: `summarize`

summarize UrlClickEvents_TimeGenerated by Id

Stage 31: `extend`

extend Description

Stage 32: `extend`

extend ActivityGroupNames

Stage 33: `project`

project AccountUpn, ActivityGroupNames, Confidence, Description, Id, NetworkMessageId, Type, Url, UrlClickEvents_TimeGenerated, ValidUntil

Stage 34: `extend`

extend timestamp

Stage 35: `extend`

extend Name, UPNSuffix, timestamp

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`IndicatorType`	eq	`url`	`field:"IndicatorType" kind:eq value:"url"`
`Url`	in	`ClickedUrls` transforms: `tolower`	`field:"Url" kind:in value:"ClickedUrls"`
`UrlClickEvents_TimeGenerated`	cross_field_compare	`ValidUntil` transforms: `op:lt`	`field:"UrlClickEvents_TimeGenerated" kind:cross_field_compare value:"ValidUntil"`
`ValidUntil`	is_null	(no value, null check)	`field:"ValidUntil" kind:is_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountUpn`	`project`
`ActivityGroupNames`	`project`
`Confidence`	`project`
`Description`	`project`
`Id`	`project`
`NetworkMessageId`	`project`
`Type`	`project`
`Url`	`project`
`UrlClickEvents_TimeGenerated`	`project`
`ValidUntil`	`project`
`timestamp`	`extend`
`Name`	`extend`
`UPNSuffix`	`extend`

TI Map URL Entity to UrlClickEvents

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: let

Stage 1: source

Stage 2: source

Stage 3: source

Stage 4: union

Stage 5: source

Stage 6: extend

Stage 7: where

Stage 8: extend

Stage 9: extend

Stage 10: where

Stage 11: where

Stage 12: summarize

Stage 13: where

Stage 14: project-rename

Stage 15: join

Stage 16: source

Stage 17: extend

Stage 18: where

Stage 19: extend

Stage 20: extend

Stage 21: where

Stage 22: where

Stage 23: summarize

Stage 24: where

Stage 25: project-rename

Stage 26: join

Stage 27: project-away

Stage 28: join

Stage 29: where

Stage 30: summarize

Stage 31: extend

Stage 32: extend

Stage 33: project

Stage 34: extend

Stage 35: extend