Service abuse: CrossTenant Microsoft notification with link

 1name: "Service abuse: CrossTenant Microsoft notification with link"
 2description: "Detects inbound messages sent from Microsoft's legitimate messaging/alert infrastructure (messaging.microsoft.com or office365alerts@microsoft.com) that carry cross-tenant headers and include at least one link in the body. Legitimate Purview encryption links and rpmsg-protected attachments are excluded, isolating cases where the trusted Microsoft notification channel is being leveraged to deliver suspicious links."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    sender.email.domain.domain == "messaging.microsoft.com"
 9    or sender.email.email == 'office365alerts@microsoft.com'
10  )
11  // CrossTenant headers
12  and any(headers.hops,
13          any(.fields,
14              strings.ilike(.name,
15                            "X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp"
16              )
17          )
18  )
19  // needs to contain at least one link
20  and length(filter(body.current_thread.links, .href_url.scheme != 'mailto')) > 0
21  // exclude Purview links or rpmsg attachments
22  and not (
23    any(body.current_thread.links,
24        strings.starts_with(.href_url.url,
25                            'https://outlook.office365.com/Encryption'
26        )
27        or .href_url.domain.domain in (
28          'purview.microsoft.com',
29          'security.microsoft.com'
30        )
31    )
32    or any(attachments,
33           .file_extension == "rpmsg"
34           or .content_type == "application/x-microsoft-rpmsg-message"
35    )
36  )  
37tags:
38  - "Attack surface reduction"
39attack_types:
40  - "Credential Phishing"
41  - "Spam"
42tactics_and_techniques:
43  - "Out of band pivot"
44  - "Social engineering"
45detection_methods:
46  - "Header analysis"
47  - "Sender analysis"
48  - "URL analysis"
49id: "45ba23f8-5ce2-5d2a-8dce-9c4cba0efe8e"