A potentially malicious URL click was detected

Question

Hi support,

We have received an alert "A potentially malicious URL click was detected" on 1 of the endpoints. We ran Full AV scan on the system but nothing was found.

Few things we need to check with you and need support:

1- Why the timeline says the link was clicked?
2- Why was this link classified as malicious?

Please have a look and let us know.

Thanks,
Imtiyaz Khan

Answer 1

Hi @Imtiyaz Khan,

Thanks for reaching out and apologies for delay in response.

I understand that you have concern on A potentially malicious URL click was detected.

The current default alert policy generates an alert on URL clicks for specific scenarios, including the primary scenario of verdict change.

It also checks for any clicks in the past 48 hours from the time the malicious URL verdict is identified and generates alerts for the clicks that happened in the 48-hour timeframe for that malicious link. This alert automatically triggers automated investigation and response in Office 365.

Reference: https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

If you require further troubleshooting on this scenario, we can then open support ticket for you.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.