SOP-41: Malicious URL Click Response

Rudra Verma, Senior Security Architect & Researcher · 2026-07-18

Safe Links wraps URLs in phishing emails and re-evaluates them at click time against Microsoft's threat intelligence. A Safe Links alert fires when a user clicks a URL that is classified as malicious — either at detonation time or via reputation update. The response priority depends on whether Safe Links blocked the navigation (low risk) or allowed click-through (user landed on the malicious page).

The two most common malicious URL scenarios are: credential harvest (fake Microsoft 365 login page) and drive-by download (browser exploit or malicious file download). Each requires a different response path.

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Malicious URL Click Attack Paths

T1566.002 / T1204.001

Safe Links evaluates URLs at click time. Attackers use URL redirection chains, time-delay detonation (URL is benign when the email is received, switches to malicious hours later), and legitimate cloud hosting (SharePoint, OneDrive, Dropbox) to host phishing pages that bypass initial scanning. The UrlClickEvents table in Defender XDR logs every Safe Links click with the final destination URL, the action taken (allowed/blocked), and whether the user overrode the warning.

Field	Value
MITRE Technique	T1566.002 — Spearphishing Link, T1204.001 — Malicious Link
Log Sources	UrlClickEvents, EmailUrlInfo, AADSignInEventsBeta, DeviceNetworkEvents
Key Fields	ActionType (ClickAllowed/ClickBlocked/ClickThroughBlocked), Url, AccountUpn
Attack Scenarios	Credential harvest page, drive-by download, OAuth consent phishing, adversary-in-the-middle (AiTM)
Detection Priority	CRITICAL if ClickAllowed — user potentially compromised

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

Safe Links Click Verdict Analysis

T1566.002

WHY CHECK

UrlClickEvents records the exact Safe Links action for every wrapped URL click. ClickAllowed means the user landed on the malicious page — this is the highest severity outcome. ClickBlocked means Safe Links stopped navigation. ClickThroughBlocked means the user saw a warning and chose to proceed anyway — this requires mandatory security awareness training at minimum.

📍 Portal Navigation — Defender XDR Advanced Hunting

security.microsoft.com› Hunting› Advanced Hunting

1Navigate to Advanced Hunting. Paste the KQL below using the user UPN and URL from the alert.
2Check ActionType: ClickAllowed is the critical outcome — the user landed on the page.
3Review the Url field for credential harvest indicators: paths like /login, /signin, /account, /verify, Microsoft or O365 branding in a non-Microsoft domain.
4Check UrlChain (if present) for redirect chains — attackers often use legitimate link shorteners or compromised websites as the first hop to evade URL reputation systems.
5If ClickAllowed: immediately run the AAD sign-in query (I2) to check if credentials were submitted and a successful sign-in occurred from an anomalous IP within minutes of the click.

ActionType	Meaning	Action
ClickAllowed	URL was allowed — user navigated to malicious page. Highest risk.	ESCALATE NOW
ClickBlocked	Safe Links blocked navigation — user did not reach the page	Block URL, monitor
ClickThroughBlocked	User overrode the Safe Links warning — reached the page despite warning	ESCALATE + training
ClickThroughWarning	User was warned but Safe Links policy allowed click-through	Check endpoint, tighten policy

DETECTS: All Safe Links click events for the affected user in the past 48 hours — reveals the URL destination, the action taken, and whether the user overrode a Safe Links warning.

KQL — Defender XDR Advanced Hunting (UrlClickEvents)

UrlClickEvents | where Timestamp > ago(48h) | where AccountUpn == "USER_UPN" or Url contains "SUSPICIOUS_DOMAIN" | project Timestamp, AccountUpn, Url, ActionType, UrlChain, NetworkMessageId, IPAddress, IsClickedThrough | order by Timestamp desc

DETECTS: Malicious URL click events in Splunk — identifies Safe Links ClickAllowed outcomes indicating the user reached a phishing or malware delivery page.

SPL — Splunk

index=* sourcetype=ms_o365_management_activity Operation=UrlClick ActionType=ClickAllowed | stats count as clicks, values(Url) as urls, values(UserId) as users by ActionType ThreatType | sort -clicks

Post-Click Credential Harvest & Account Compromise Check

T1204.001

WHY CHECK

If the user landed on a credential harvest page, they may have submitted their username and password. Check Azure AD sign-in logs for a successful login from an anomalous IP or unfamiliar location occurring within 15 minutes of the URL click — this is the strongest indicator of credential compromise following a phishing click.

📍 Portal Navigation — Entra ID Sign-in Logs

entra.microsoft.com› Identity› Monitoring → Sign-in logs

1Navigate to Entra ID → Monitoring → Sign-in logs. Filter by the affected user and the time window starting from the URL click timestamp.
2Look for successful (Success) sign-ins from IP addresses not matching the user's known locations or corporate IP range — this indicates stolen credentials were used immediately.
3Check for AiTM indicators: successful MFA-bypassed sessions where the session cookie was captured (token theft). Indicators: sign-in from a hosting provider IP, TokenIssuerType = AzureAD with no MFA step.
4Run the KQL below to check for anomalous sign-ins in the 30 minutes after the click event.
5If an anomalous successful sign-in is found: immediately revoke all user sessions in Entra ID (User → Revoke sessions) and reset the password.

DETECTS: Successful Azure AD sign-ins from anomalous IPs in the 30-minute window after a malicious URL click — the primary indicator of credential harvest success following phishing link click-through.

KQL — Microsoft Sentinel (SigninLogs)

let ClickTime = datetime("CLICK_TIMESTAMP"); SigninLogs | where TimeGenerated between (ClickTime .. (ClickTime + 30m)) | where UserPrincipalName == "USER_UPN" | where ResultType == "0" | project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ConditionalAccessStatus, AuthenticationDetails, RiskLevelAggregated | order by TimeGenerated asc

DETECTS: Post-click sign-in anomalies in Splunk — flags successful authentications from new geographic locations within 30 minutes of a Safe Links click event.

SPL — Splunk

index=* sourcetype=azure_ad_signin user="USER_UPN" result=Success | where _time >= relative_time(now(), "-30m") | stats count as logins, values(src_ip) as ips, values(country) as countries by user app auth_method | sort -logins

AiTM (Adversary-in-the-Middle) phishing kits capture the session cookie after MFA, meaning even users with MFA enabled can be compromised. If the sign-in succeeded without a visible MFA prompt in the auth logs, or MFA was satisfied via a previously cached token, treat as AiTM and revoke all tokens immediately.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED ClickAllowed AND anomalous sign-in or session cookie theft detected → Revoke all sessions, reset password, check mailbox rules for attacker persistence

PARTIAL ClickAllowed but no sign-in anomaly detected — possible drive-by download → Triage endpoint for browser-delivered malware, check DeviceFileEvents for downloads

FALSE POSITIVE ClickBlocked confirmed, URL reputation updated, no user navigation to page → Block URL, block sender, close ticket

Session Revocation & Account Containment

CONTAINMENT

1Revoke all active sessions in Entra ID: Users → [User] → Revoke sessions. This invalidates all access tokens and refresh tokens.
2Reset the user's password to a new randomly generated value and require re-registration of MFA methods.
3Check mailbox rules for attacker-created forwarding rules: Exchange Admin Center → [Mailbox] → Inbox rules. Delete any rules that forward email to external addresses.
4Block the malicious URL in Safe Links: Threat Policies → Safe Links → Block the following URLs.
5Block the sender domain and check whether the same URL was sent to other users in the campaign.

🗑

04 — ERADICATION

CLEANUP

Account Cleanup & Safe Links Hardening

ERADICATION

1Audit OAuth app consents granted by the affected user: Entra ID → Enterprise Applications → filter by User. Revoke any suspicious third-party app consents.
2Review Exchange mail flow rules for any attacker-added transport rules forwarding mail externally: Exchange Admin Center → Mail flow → Rules.
3Tighten Safe Links policy: disable Allow users to click through to original URL and enable Do not track when users click Safe Links being off (ensure tracking is on).
4Enrol the user in mandatory phishing simulation training: Attack Simulation Training in Defender XDR.
5Verify the malicious URL is blocked in Safe Links and Defender for Endpoint web content filtering across all users, not just the affected account.

Eradication Complete When

User sessions revoked and password reset confirmed
No active sessions from anomalous IPs visible in sign-in logs
Malicious inbox forwarding rules removed
Malicious URL blocked in Safe Links policy
User enrolled in phishing awareness training

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
AiTM confirmed, MFA bypassed	SEV1	Revoke all tokens, reset password, full account audit	SOC Lead → CISO → IT Security
ClickAllowed + anomalous sign-in	SEV1	Revoke sessions, password reset, mailbox audit	SOC Lead → CISO
ClickAllowed, no sign-in anomaly, endpoint clean	SEV3	Block URL, user warning, 24h monitoring	SOC Lead
ClickBlocked, no user navigation	SEV4	Block URL/sender, document, close	Ticket only

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.