Investigating a phishing report with KQL, end to end

02 · Scope — who else received it

It's never one recipient. Pivot to the full campaign footprint.

EmailEvents
| where Timestamp > ago(7d)
| where SenderFromAddress == "attacker@evil-domain.com"
    or Subject has "Shared invoice document"
| summarize Recipients = make_set(RecipientEmailAddress),
            Count = dcount(RecipientEmailAddress)
        by Subject, SenderFromAddress, DeliveryAction, DeliveryLocation

The Recipients set is your true blast radius. Watch the DeliveryAction split — often some copies were Delivered and some Junked, which tells you who's actually exposed. Attackers vary subjects across a wave, so for precision, match on the URL or attachment hash (next check) rather than subject alone.

03 · Extract the IOCs

You need these for the click check and for blocking.

// URLs in the message(s)
EmailEvents
| where NetworkMessageId in ("<id1>", "<id2>")
| join kind=inner EmailUrlInfo on NetworkMessageId
| project NetworkMessageId, RecipientEmailAddress, Url, UrlDomain

// attachments + hashes
EmailAttachmentInfo
| where NetworkMessageId in ("<id1>", "<id2>")
| project NetworkMessageId, FileName, FileType, SHA256, ThreatTypes

These Url / UrlDomain / SHA256 values are what you'll block in the Tenant Allow/Block List, and the URLs feed straight into the click check next. Note the domain as well as the full URL — attackers rotate paths on the same host.

04 · Did anyone actually click? the hinge

"Not clicked" is proven by an empty result, never assumed.

let msgIds = dynamic(["<id1>", "<id2>"]);
let phishUrls = EmailUrlInfo
    | where NetworkMessageId in (msgIds)
    | distinct Url;
UrlClickEvents
| where Timestamp > ago(7d)
| where NetworkMessageId in (msgIds) or Url in (phishUrls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough, IPAddress

05 · Did the system already clean it up?

Check ZAP and other post-delivery actions before you remediate by hand.

EmailPostDeliveryEvents
| where NetworkMessageId in ("<id1>", "<id2>")
| project Timestamp, NetworkMessageId, RecipientEmailAddress,
          ActionType, Action, ActionResult

A ZAP action with ActionResult == "Success" means the message was auto-pulled from inboxes post-delivery — don't double-remediate what's already gone. An empty result means nothing was auto-actioned; it's still wherever it landed, and it's on you to purge.

06 · Auth posture — spoof or compromised sender?

This changes your entire response.

EmailEvents
| where NetworkMessageId == "<id1>"
| extend Auth = parse_json(AuthenticationDetails)
| project SenderFromAddress, SenderMailFromAddress, SenderIPv4,
          SPF = Auth.SPF, DKIM = Auth.DKIM, DMARC = Auth.DMARC, CompAuth = Auth.CompAuth

08 · Did the click compromise the account?

Pivot to identity. Both tables — not every tenant streams the Beta one.

// Entra sign-ins in the 24h after the click
let clickTime = datetime(2026-01-01T00:00:00Z);   // from Check 7
AADSignInEventsBeta
| where Timestamp between (clickTime .. (clickTime + 24h))
| where AccountUpn == "victim@contoso.com"
| project Timestamp, IPAddress, Country, City, ClientAppUsed,
          ErrorCode, RiskLevelDuringSignIn, ConditionalAccessStatus, UserAgent
| sort by Timestamp asc

// fallback / corroboration if the Beta table isn't populated
IdentityLogonEvents
| where Timestamp between (clickTime .. (clickTime + 24h))
| where AccountUpn == "victim@contoso.com"
| project Timestamp, LogonType, Application, IPAddress, DeviceName, ActionType

Successful sign-ins (ErrorCode == 0) from a new country/IP shortly after the click = likely token theft / AiTM. RiskLevelDuringSignIn = high, or ClientAppUsed showing legacy/unusual clients, are red flags. A successful sign-in that satisfied Conditional Access from an attacker IP is the token-replay signature — cross-reference the account-takeover playbook for the full identity response.

09 · Persistence — the part that keeps them in critical

Inbox rules, MFA tampering, forwarding. A password reset alone removes none of these.

let clickTime = datetime(2026-01-01T00:00:00Z);
CloudAppEvents
| where Timestamp between (clickTime .. (clickTime + 24h))
| where AccountId == "<victim-object-id>" or AccountDisplayName has "victim"
| where ActionType in ("New-InboxRule","Set-InboxRule","Set-Mailbox",
        "Update user.","Add app role assignment to service principal.",
        "Register security info.","Disable Strong Authentication.",
        "Update StsRefreshTokenValidFrom Timestamp.","Add-MailboxPermission")
| project Timestamp, ActionType, AccountDisplayName, IPAddress, RawEventData
| sort by Timestamp asc

10 · Trace the forwards (the victim re-sent the phish)

Two directions to catch — internal and external.

let phishUrls = EmailUrlInfo | where NetworkMessageId in (msgIds) | distinct Url;
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromAddress == "victim@contoso.com"
| join kind=leftouter EmailUrlInfo on NetworkMessageId
| where Url in (phishUrls) or Subject has "Shared invoice document"
        or Subject has "FW:" or Subject has "Fwd:"
| project Timestamp, NetworkMessageId, RecipientEmailAddress,
          EmailDirection, Subject, Url, DeliveryAction, DeliveryLocation
| sort by Timestamp asc

EmailDirection splits your two blast fronts — Intraorg (internal recipients — brand-new potential victims inside the org) vs Outbound (external recipients — reputational damage, and you must notify them). Collect every RecipientEmailAddress; that's wave two.

11 · Scope wave two by direction

A clean two-line answer: how many internal, how many external.

EmailEvents
| where Timestamp > ago(7d)
| where SenderFromAddress == "victim@contoso.com"
| where Subject has_any ("Shared invoice document", "FW:", "Fwd:")
| summarize Recipients = make_set(RecipientEmailAddress),
            Count = dcount(RecipientEmailAddress)
        by EmailDirection

Internal names go straight into the same investigation — check their clicks next (Check 12). External names go onto a notification list; those organisations need to know a phish came from your user. The counts also size the incident for your report.

12 · Did wave-two recipients click? (recurse the hinge)

The same payload, carried in the forward, against new people.

let wave2Urls = phishUrls;   // same payload carried in the forward
UrlClickEvents
| where Timestamp > ago(7d)
| where Url in (wave2Urls)
| where AccountUpn != "victim@contoso.com"     // exclude patient zero
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough, IPAddress
| sort by Timestamp asc

13 · Endpoint fallout, if a link led to a download

Catch the case where the "document" pulled a payload.

let clickTime = datetime(2026-01-01T00:00:00Z);
DeviceNetworkEvents
| where Timestamp between (clickTime .. (clickTime + 2h))
| where InitiatingProcessAccountUpn == "victim@contoso.com"
| where RemoteUrl in (phishUrls) or RemoteUrl has "evil-domain.com"
| project Timestamp, DeviceName, RemoteUrl, RemoteIP,
          InitiatingProcessFileName, InitiatingProcessCommandLine

Outbound connections to the phish domain, and the process that made them. If the initiating process is a browser it's likely just the click; if it's a script host (powershell.exe, mshta.exe) you've got execution — pivot to DeviceProcessEvents / DeviceFileEvents for the dropped file and treat it as an endpoint compromise.

14 · Containment & the consolidated IOC block

One query to assemble every indicator to block.

EmailEvents | where NetworkMessageId in (msgIds)
| join kind=leftouter EmailUrlInfo on NetworkMessageId
| join kind=leftouter EmailAttachmentInfo on NetworkMessageId
| summarize Senders = make_set(SenderFromAddress),
            Domains = make_set(UrlDomain),
            Urls    = make_set(Url),
            Hashes  = make_set(SHA256)