Whos Clicking On Junk Mail

Users who clicked links in messages that landed in the Junk folder — a strong 'who needs training' signal.

KQL Library  /  Email & Phishing

 Email & Phishing whos-clicking-on-junk-mail.kql

Users who clicked links in messages that landed in the Junk folder — a strong "who needs training" signal.

Tactics Initial Access
Techniques T1566.002
Platforms Microsoft 365
Data UrlClickEvents
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: KQL Toolbox #6: From Junk Clicks to Identity & Privilege Control (2026-01-31) — https://www.hanley.cloud/2026-01-31-KQL-Toolbox-6-From-Junk-Clicks-to-Identity-%26-Privilege-Control/
// Tactics: Initial Access
// Techniques: T1566.002
// Platforms: Microsoft 365
// Data: UrlClickEvents
let JunkedEmails = EmailEvents
| where DeliveryLocation == "Junk folder"
| distinct NetworkMessageId;
UrlClickEvents
| where NetworkMessageId in(JunkedEmails)