← Back to SOC feed Coverage →

Appspot Phishing Abuse

kql MEDIUM Azure-Sentinel
T1566
EmailEventsEmailUrlInfo
huntingmicrosoftofficialphishing
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-13T11:00:00Z · Confidence: medium

Hunt Hypothesis

Attackers are leveraging Appspot to host phishing pages and distribute malicious links, exploiting the platform’s accessibility to compromise user credentials. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate phishing campaigns that bypass traditional email security controls.

KQL Query

EmailUrlInfo
// Detect URLs with a subdomain on appspot.com
| where UrlDomain matches regex @'\b[\w\-]+-dot-[\w\-\.]+\.appspot\.com\b'
// Enrich results with sender and recipient data
| join kind=inner EmailEvents on $left.NetworkMessageId==$right.NetworkMessageId
// Phishing attempts from Appspot related campaigns typically contain the recipient's email address in the URI
// Example 1: https://example-dot-example.appspot.com/#[email protected]
// Example 2: https://example-dot-example.appspot.com/[email protected]
| where Url has RecipientEmailAddress
    // Some phishing campaigns pass recipient email as a Base64 encoded string in the URI
    or Url has base64_encode_tostring(RecipientEmailAddress)
| project-away Timestamp1, NetworkMessageId1, ReportId1

Analytic Rule Definition

id: cdac93ef-56c0-45bf-9e7f-9cbf0ad06808
name: Appspot Phishing Abuse
description: |
  This query helps surface phishing campaigns associated with Appspot abuse.
description-detailed: |
  This query helps surface phishing campaigns associated with Appspot abuse. These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the URI.
  This campaign was published on Twitter by @MsftSecIntel at this link: https://twitter.com/MsftSecIntel/status/1374148156301004800
  Reference - https://twitter.com/MsftSecIntel
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailUrlInfo
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailUrlInfo
  // Detect URLs with a subdomain on appspot.com
  | where UrlDomain matches regex @'\b[\w\-]+-dot-[\w\-\.]+\.appspot\.com\b'
  // Enrich results with sender and recipient data
  | join kind=inner EmailEvents on $left.NetworkMessageId==$right.NetworkMessageId
  // Phishing attempts from Appspot related campaigns typically contain the recipient's email address in the URI
  // Example 1: https://example-dot-example.appspot.com/#[email protected]
  // Example 2: https://example-dot-example.appspot.com/[email protected]
  | where Url has RecipientEmailAddress
      // Some phishing campaigns pass recipient email as a Base64 encoded string in the URI
      or Url has base64_encode_tostring(RecipientEmailAddress)
  | project-away Timestamp1, NetworkMessageId1, ReportId1
version: 1.0.0

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled
EmailUrlInfoEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Phish/Appspot phishing abuse.yaml