Service abuse: Microsoft Forms Pro with suspicious links or QR codes

calendar Jul 14, 2026  ·
Share on: linkedin copy

Detects messages sent from Microsoft Forms Pro (surveys@email.formspro.microsoft.com) that contain suspicious indicators, including links to suspicious TLDs, recipient email addresses embedded in URLs, OAuth authorization links, personal OneDrive paths, template placeholders, or QR codes pointing to recently registered or suspicious domains.

Sublime rule (View on GitHub)

 1name: "Service abuse: Microsoft Forms Pro with suspicious links or QR codes"
 2description: "Detects messages sent from Microsoft Forms Pro (surveys@email.formspro.microsoft.com) that contain suspicious indicators, including links to suspicious TLDs, recipient email addresses embedded in URLs, OAuth authorization links, personal OneDrive paths, template placeholders, or QR codes pointing to recently registered or suspicious domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == 'surveys@email.formspro.microsoft.com'
 8  and (
 9    any(body.current_thread.links,
10        (
11          .href_url.domain.tld in $suspicious_tlds
12          and not .href_url.domain.root_domain in ('microsoft.us')
13        )
14        or any(recipients.to,
15               strings.icontains(..href_url.url, .email.email)
16               and .email.domain.valid
17        )
18        or .href_url.fragment in ('[[Email]]')
19        or strings.starts_with(.href_url.url,
20                               'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
21        )
22        // personal onedrive
23        or strings.starts_with(.href_url.path, '/:o:/p/')
24    )
25    or any(file.explode(file.message_screenshot()),
26           .scan.qr.url.domain.tld in $suspicious_tlds
27           or network.whois(.scan.qr.url.domain).days_old < 100
28    )
29  )  
30attack_types:
31  - "Credential Phishing"
32tactics_and_techniques:
33  - "QR code"
34  - "Social engineering"
35  - "Impersonation: Brand"
36detection_methods:
37  - "URL analysis"
38  - "QR code analysis"
39  - "Sender analysis"
40  - "Whois"
41  - "Content analysis"
42id: "a5dcd463-ab7b-5592-84f3-445340286354"
to-top