User Information Collected Externally When A URL Is Clicked
Query
UrlClickEvents
| where Url contains ".pstmrk.it"
| join kind=inner (EmailEvents) on $left.NetworkMessageId == $right.NetworkMessageId
| where DeliveryLocation has "Inbox"About this query
Explanation
This query is designed to identify potential phishing activities by tracking when users click on specific URLs in emails. Here's a simplified breakdown:
-
Context: The query is related to a phishing technique known as "Spearphishing Link" (MITRE ATT&CK Technique ID T1598.003). This involves sending targeted emails with links that, when clicked, can collect user information.
-
Mechanism: The query focuses on URLs that include "track.pstmrk.it". This indicates the use of Postmark's link tracking feature, which replaces original links in emails with tracking links. When a user clicks on these links, information such as their location, browser type, and the part of the email where the link was clicked is recorded.
-
Query Explanation:
- The query searches for events where URLs contain ".pstmrk.it", indicating they are tracking links.
- It joins these URL click events with email events based on a common identifier (
NetworkMessageId), ensuring that the URL click is associated with a specific email. - It filters the results to only include emails delivered to the "Inbox", suggesting these are legitimate emails that reached the user.
-
Purpose: By identifying when users click on these tracking links, the query helps detect potential phishing attempts where malicious actors could be gathering information for further attacks. This information can be used to enhance security measures and protect users from targeted phishing campaigns.
