Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-PretextingReconEmailTrackingBeacon.
Upgrade to ProDetect Pretexting Reconnaissance Email with Tracking Pixel / Beacon Link in Microsoft Sentinel
Before committing to a spearphishing attachment (T1598.002) or spearphishing link (T1598.003) payload, adversaries increasingly send an innocuous, low-payload pretexting email first — a brief 'checking in', 'meeting request', or 'invoice follow-up' message with no attachment and no overt malicious link. The email instead embeds a uniquely-tokenized tracking pixel (a 1x1 image or invisible-CSS beacon) or a benign-looking beacon link, where the token is minted per-recipient. When the recipient's mail client renders the image or a human clicks the link, the beacon fires a GET request back to adversary-controlled infrastructure, confirming the mailbox is live, fingerprinting the recipient's IP address, approximate geolocation, mail client/user agent, and open time, and validating that a real human (not a sandbox or secure email gateway detonation chamber) triggered it. Star Blizzard, TA453, and TA427 have been documented using single-pixel and unique-URL tracking beacons in low-content reconnaissance emails to qualify targets and time follow-on credential-harvesting or malware-laden messages for when the mailbox is confirmed active. Because these emails carry no attachment and no overtly malicious URL pattern, they routinely pass secure email gateway and sandbox scoring; detection instead relies on correlating the low-payload email itself (via EmailEvents/EmailUrlInfo) with the subsequent beacon fetch observed in web proxy/gateway logs.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
let TrackingTokenPattern = @"[?&](uid|id|token|tid|rid|cid|pid|mid|track|beacon|open|px)=[A-Za-z0-9\-_]{8,}";
let PixelExtensions = dynamic([".gif", ".png", ".jpg", ".jpeg"]);
let FreemailDomains = dynamic(["gmail.com", "yahoo.com", "hotmail.com", "outlook.com", "protonmail.com", "tutanota.com", "icloud.com", "aol.com"]);
// Alert 1: Low-payload external email (no attachment, at most one embedded URL) carrying
// a uniquely-tokenized tracking pixel or beacon link — the pretexting recon signature
let CandidateEmails = EmailEvents
| where Timestamp > ago(7d)
| where EmailDirection == "Inbound"
| where DeliveryAction !in ("Blocked", "Junked")
| where AttachmentCount == 0
| where UrlCount <= 2
| project NetworkMessageId, Timestamp, SenderFromAddress, SenderFromDomain, SenderMailFromDomain,
RecipientEmailAddress, Subject, UrlCount, AuthenticationDetails;
CandidateEmails
| join kind=inner (
EmailUrlInfo
| where Timestamp > ago(7d)
| extend HasTrackingToken = Url matches regex TrackingTokenPattern
| extend IsPixelUrl = UrlDomain != "" and PixelExtensions has_any (dynamic([".gif", ".png", ".jpg", ".jpeg"])) and (Url endswith ".gif" or Url endswith ".png" or Url endswith ".jpg" or Url endswith ".jpeg")
| where HasTrackingToken or IsPixelUrl
| project NetworkMessageId, Url, UrlDomain, HasTrackingToken, IsPixelUrl
) on NetworkMessageId
| extend FreemailSender = SenderFromDomain in~ (FreemailDomains)
| extend SuspicionScore = toint(HasTrackingToken) + toint(IsPixelUrl) + toint(FreemailSender)
| where SuspicionScore >= 1
| extend ThreatType = "PretextingRecon_TrackingBeaconEmail"
| project Timestamp, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, RecipientEmailAddress,
Subject, Url, UrlDomain, HasTrackingToken, IsPixelUrl, FreemailSender, UrlCount, SuspicionScore, ThreatType
| sort by Timestamp desc;
// Alert 2: Confirm the beacon fired — the recipient's own device generated an outbound
// request to the tracking domain shortly after the email was delivered (target validated)
let BeaconCandidates = CandidateEmails
| join kind=inner (
EmailUrlInfo
| where Timestamp > ago(7d)
| where Url matches regex TrackingTokenPattern
| project NetworkMessageId, Url, UrlDomain
) on NetworkMessageId
| project DeliveryTime = Timestamp, RecipientEmailAddress, SenderFromDomain, Url, UrlDomain;
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor has_any ("Zscaler", "BlueCoat", "McAfee", "Squid", "Forcepoint", "Palo Alto Networks")
| where isnotempty(RequestURL)
| join kind=inner BeaconCandidates on $left.RequestURL == $right.Url
| where datetime_diff('minute', TimeGenerated, DeliveryTime) between (0 .. 4320)
| extend ThreatType = "PretextingRecon_BeaconFired_TargetValidated"
| project TimeGenerated, DeliveryTime, SourceUserName, SourceIP, RequestURL, UrlDomain,
RecipientEmailAddress, SenderFromDomain, ThreatType
| sort by TimeGenerated descTwo-stage detection: (1) identifies inbound emails with no attachment and at most one embedded URL where that URL carries a unique per-recipient tracking token (query parameters like uid=, token=, tid=) or points to a raster image beacon (.gif/.png/.jpg) — the structural fingerprint of a pretexting reconnaissance email, distinct from bulk marketing tracking which typically ships alongside rich HTML content and multiple links; (2) correlates the flagged email's tracking URL against subsequent web proxy/gateway request logs within a 3-day window to confirm the recipient's device actually fetched the beacon, which validates the mailbox is live and the target has been fingerprinted ahead of a follow-on attack. Alert 2 firing is the higher-fidelity signal since it proves human interaction rather than just email delivery.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate email marketing and newsletter platforms (Mailchimp, HubSpot, SendGrid, Constant Contact) that embed open-tracking pixels and per-recipient click-tracking links for engagement analytics — these typically arrive at higher volume with consistent sender domains and can be allow-listed
- Sales engagement and outreach tools (Outreach.io, Salesloft, Yesware, Mixmax) used by legitimate business development teams, which embed identical per-recipient tracking pixel patterns for email-open notifications
- Calendar/meeting scheduling tools (Calendly, Doodle) that include tracking parameters in confirmation links sent to recipients
- Read-receipt and delivery-confirmation features built into legitimate CRM or helpdesk platforms (Salesforce, Zendesk, Intercom) that use similarly structured per-message tracking tokens
Other platforms for THREAT-Recon-PretextingReconEmailTrackingBeacon
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Low-Payload Email with Unique Tracking Token URL
Expected signal: EmailEvents record with AttachmentCount=0, UrlCount=1; EmailUrlInfo record for the tracking URL containing a uid= query parameter matching the tracking token regex.
- Test 2Tracking Pixel Beacon Fetch Simulation
Expected signal: Web proxy/gateway access log entry showing a GET request to status-updates-portal.example/px.gif with the uid= tracking parameter, timestamped shortly after the simulated email delivery.
- Test 3Bulk Freemail Sender Recon Email Without Tracking Token (Negative Control)
Expected signal: EmailEvents record with AttachmentCount=0, UrlCount=0; no EmailUrlInfo record for this NetworkMessageId.
References (5)
- https://attack.mitre.org/techniques/T1598/002/
- https://attack.mitre.org/techniques/T1598/003/
- https://www.proofpoint.com/us/blog/threat-insight
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-hunting-emailurlinfo-table
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-hunting-emailevents-table
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-PretextingReconEmailTrackingBeacon — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month