Whos Clicking On Junk Mail

Users who clicked links in messages that landed in the Junk folder — a strong 'who needs training' signal.

KQL Library  /  Email & Phishing

 Email & Phishing whos-clicking-on-junk-mail.kql

Users who clicked links in messages that landed in the Junk folder — a strong "who needs training" signal.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
let JunkedEmails = EmailEvents
| where DeliveryLocation == "Junk folder"
| distinct NetworkMessageId;
UrlClickEvents
| where NetworkMessageId in(JunkedEmails)