Pretexting Reconnaissance Email with Tracking Pixel / Beacon Link

let TrackingTokenPattern = @"[?&](uid|id|token|tid|rid|cid|pid|mid|track|beacon|open|px)=[A-Za-z0-9\-_]{8,}";
let PixelExtensions = dynamic([".gif", ".png", ".jpg", ".jpeg"]);
let FreemailDomains = dynamic(["gmail.com", "yahoo.com", "hotmail.com", "outlook.com", "protonmail.com", "tutanota.com", "icloud.com", "aol.com"]);
// Alert 1: Low-payload external email (no attachment, at most one embedded URL) carrying
// a uniquely-tokenized tracking pixel or beacon link — the pretexting recon signature
let CandidateEmails = EmailEvents
| where Timestamp > ago(7d)
| where EmailDirection == "Inbound"
| where DeliveryAction !in ("Blocked", "Junked")
| where AttachmentCount == 0
| where UrlCount <= 2
| project NetworkMessageId, Timestamp, SenderFromAddress, SenderFromDomain, SenderMailFromDomain,
    RecipientEmailAddress, Subject, UrlCount, AuthenticationDetails;
CandidateEmails
| join kind=inner (
    EmailUrlInfo
    | where Timestamp > ago(7d)
    | extend HasTrackingToken = Url matches regex TrackingTokenPattern
    | extend IsPixelUrl = UrlDomain != "" and PixelExtensions has_any (dynamic([".gif", ".png", ".jpg", ".jpeg"])) and (Url endswith ".gif" or Url endswith ".png" or Url endswith ".jpg" or Url endswith ".jpeg")
    | where HasTrackingToken or IsPixelUrl
    | project NetworkMessageId, Url, UrlDomain, HasTrackingToken, IsPixelUrl
) on NetworkMessageId
| extend FreemailSender = SenderFromDomain in~ (FreemailDomains)
| extend SuspicionScore = toint(HasTrackingToken) + toint(IsPixelUrl) + toint(FreemailSender)
| where SuspicionScore >= 1
| extend ThreatType = "PretextingRecon_TrackingBeaconEmail"
| project Timestamp, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, RecipientEmailAddress,
    Subject, Url, UrlDomain, HasTrackingToken, IsPixelUrl, FreemailSender, UrlCount, SuspicionScore, ThreatType
| sort by Timestamp desc;
// Alert 2: Confirm the beacon fired — the recipient's own device generated an outbound
// request to the tracking domain shortly after the email was delivered (target validated)
let BeaconCandidates = CandidateEmails
| join kind=inner (
    EmailUrlInfo
    | where Timestamp > ago(7d)
    | where Url matches regex TrackingTokenPattern
    | project NetworkMessageId, Url, UrlDomain
) on NetworkMessageId
| project DeliveryTime = Timestamp, RecipientEmailAddress, SenderFromDomain, Url, UrlDomain;
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor has_any ("Zscaler", "BlueCoat", "McAfee", "Squid", "Forcepoint", "Palo Alto Networks")
| where isnotempty(RequestURL)
| join kind=inner BeaconCandidates on $left.RequestURL == $right.Url
| where datetime_diff('minute', TimeGenerated, DeliveryTime) between (0 .. 4320)
| extend ThreatType = "PretextingRecon_BeaconFired_TargetValidated"
| project TimeGenerated, DeliveryTime, SourceUserName, SourceIP, RequestURL, UrlDomain,
    RecipientEmailAddress, SenderFromDomain, ThreatType
| sort by TimeGenerated desc

index=o365 sourcetype="o365:management:activity" Workload=Exchange Operation=MessageReceived
| eval AttachmentCount=coalesce(AttachmentCount, 0)
| eval UrlList=coalesce(Urls, "")
| eval UrlCount=if(isnull(UrlList) OR UrlList=="", 0, mvcount(split(UrlList, ";")))
| where AttachmentCount=0 AND UrlCount<=2 AND UrlCount>0
| eval HasTrackingToken=if(match(UrlList, "[?&](uid|id|token|tid|rid|cid|pid|mid|track|beacon|open|px)=[A-Za-z0-9_\-]{8,}"), 1, 0)
| eval IsPixelUrl=if(match(UrlList, "\.(gif|png|jpe?g)(\?|$)"), 1, 0)
| eval FreemailSender=if(match(SenderAddress, "@(gmail|yahoo|hotmail|outlook|protonmail|tutanota|icloud|aol)\."), 1, 0)
| eval SuspicionScore=HasTrackingToken + IsPixelUrl + FreemailSender
| where SuspicionScore>=1
| eval ThreatType="PretextingRecon_TrackingBeaconEmail"
| table _time, SenderAddress, RecipientAddress, Subject, UrlList, HasTrackingToken, IsPixelUrl, FreemailSender, SuspicionScore, ThreatType
| sort - _time

/* Alert 1: pretexting recon email — no attachment, <=2 URLs, tracking token or pixel extension */
/* Run against email security telemetry ingested as ECS via Elastic email connectors (O365/Defender ingest) */
sequence by email.message_id with maxspan=1m
  [email where event.type == "info" and
    email.direction == "inbound" and
    email.attachments == null]
  [url where url.query : "*uid=*" or url.query : "*token=*" or url.query : "*tid=*" or
    url.path : ("*.gif", "*.png", "*.jpg", "*.jpeg")]

/* Alert 2: beacon fire confirmation — proxy/network request to the tracking URL after delivery */
/* sequence by url.full with maxspan=3d
  [email where event.type == "info" and email.direction == "inbound"]
  [network where event.type == "connection" and destination.domain == url.domain]
*/

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  "SenderAddress" AS SenderAddress,
  "RecipientAddress" AS RecipientAddress,
  "Subject" AS Subject,
  "AttachmentCount" AS AttachmentCount,
  "UrlList" AS UrlList,
  CASE
    WHEN "UrlList" ILIKE '%uid=%' OR "UrlList" ILIKE '%token=%' OR "UrlList" ILIKE '%tid=%'
      OR "UrlList" ILIKE '%track=%' OR "UrlList" ILIKE '%beacon=%'
    THEN 1 ELSE 0
  END AS HasTrackingToken,
  CASE
    WHEN "UrlList" ILIKE '%.gif%' OR "UrlList" ILIKE '%.png%' OR "UrlList" ILIKE '%.jpg%' OR "UrlList" ILIKE '%.jpeg%'
    THEN 1 ELSE 0
  END AS IsPixelUrl
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Office 365%'
  AND "AttachmentCount" = 0
  AND (
    "UrlList" ILIKE '%uid=%' OR "UrlList" ILIKE '%token=%' OR "UrlList" ILIKE '%tid=%'
    OR "UrlList" ILIKE '%track=%' OR "UrlList" ILIKE '%beacon=%'
    OR "UrlList" ILIKE '%.gif%' OR "UrlList" ILIKE '%.png%'
  )
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=*o365*email* OR _sourceCategory=*exchange*
| where Operation = "MessageReceived"
| where AttachmentCount = 0
| parse field=Urls "*" as UrlList nodrop
| where UrlList matches "*uid=*" or UrlList matches "*token=*" or UrlList matches "*tid=*" or UrlList matches "*track=*" or UrlList matches "*.gif*" or UrlList matches "*.png*"
| eval HasTrackingToken = if (UrlList matches "*uid=*" or UrlList matches "*token=*" or UrlList matches "*tid=*" or UrlList matches "*track=*", "YES", "NO")
| eval IsPixelUrl = if (UrlList matches "*.gif*" or UrlList matches "*.png*" or UrlList matches "*.jpg*", "YES", "NO")
| eval ThreatType = "PretextingRecon_TrackingBeaconEmail"
| fields _messageTime, SenderAddress, RecipientAddress, Subject, UrlList, HasTrackingToken, IsPixelUrl, ThreatType
| count by SenderAddress, RecipientAddress, HasTrackingToken, IsPixelUrl, ThreatType
| sort - _count

rule pretexting_recon_tracking_beacon_email {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects low-payload pretexting reconnaissance emails carrying a unique per-recipient tracking pixel or beacon link, used to fingerprint and validate live targets ahead of a follow-on spearphishing attack."
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1598.002"
    mitre_attack_subtechnique = "T1598.003"
    reference = "https://attack.mitre.org/techniques/T1598/003/"
    created = "2026-07-19"
    version = "1.0"

  events:
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.direction = "INBOUND"
    $email.network.email.attachments = 0
    $email.target.url.query = /(?i)(uid|id|token|tid|rid|cid|pid|mid|track|beacon|open|px)=[A-Za-z0-9_-]{8,}/
    $email.principal.hostname = $hostname

  condition:
    $email
}

rule pretexting_recon_beacon_fired {
  meta:
    author = "df00tech Detection Engineering"
    description = "Correlates a flagged pretexting tracking URL with a subsequent outbound network request to the same domain, confirming the beacon fired and the target mailbox was validated as live."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1598.003"
    created = "2026-07-19"
    version = "1.0"

  events:
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.target.url.domain = $domain

    $net.metadata.event_type = "NETWORK_HTTP"
    $net.target.url.domain = $domain
    $net.principal.hostname = $hostname

  match:
    $domain over 3d

  condition:
    $email and $net
}

// Alert 1: pretexting recon email — zero attachments, tracking-token or pixel URL
#event_simpleName=EmailMessage
| AttachmentCount = 0
| UrlList = /(?i)(uid|id|token|tid|rid|cid|pid|mid|track|beacon|open|px)=[A-Za-z0-9_-]{8,}/
  OR UrlList = /(?i)\.(gif|png|jpe?g)(\?|$)/
| HasTrackingToken := if(UrlList =~ /(?i)(uid|token|tid|rid|cid|pid|mid|track|beacon)=/, "YES", "NO")
| IsPixelUrl := if(UrlList =~ /(?i)\.(gif|png|jpe?g)(\?|$)/, "YES", "NO")
| ThreatType := "PretextingRecon_TrackingBeaconEmail"
| groupBy(
    [SenderAddress, RecipientAddress, HasTrackingToken, IsPixelUrl, ThreatType],
    function=[count(as=EventCount), values(Subject, as=Subjects), values(UrlList, as=Urls)]
  )
| sort(EventCount, order=desc)

// Alert 2 (run separately): beacon fire confirmation via web proxy telemetry
// #event_simpleName=/(HttpRequestHeader|DnsRequest)/
// | join(
//   {#event_simpleName=EmailMessage | UrlList = /(?i)(uid|token|tid)=/ | groupBy([RecipientAddress], function=collect([UrlList], as=TrackingUrls))},
//   field=[RecipientAddress], mode=inner
// )
// | RequestURL = TrackingUrls