Service abuse: Microsoft messaging with suspicious recipient-referencing link

calendar Oct 27, 2026  ·
Share on: linkedin copy

Detects inbound messages sent through Microsoft's messaging.microsoft.com infrastructure containing links that reference the recipient's own domain in the URL. These links contain either a suspicious token pattern (a long numeric token or a malformed query parameter) or route through a Cloudflare Turnstile challenge, techniques used to deliver per-recipient phishing payloads while evading automated security scanners.

Sublime rule (View on GitHub)

 1name: "Service abuse: Microsoft messaging with suspicious recipient-referencing link"
 2description: "Detects inbound messages sent through Microsoft's messaging.microsoft.com infrastructure containing links that reference the recipient's own domain in the URL. These links contain either a suspicious token pattern (a long numeric token or a malformed query parameter) or route through a Cloudflare Turnstile challenge, techniques used to deliver per-recipient phishing payloads while evading automated security scanners."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and sender.email.domain.domain == 'messaging.microsoft.com'
 8  and any(filter(body.current_thread.links, .href_url.scheme != 'mailto'),
 9          strings.contains(.href_url.url, recipients.to[0].email.domain.domain)
10          and (
11            regex.icontains(.href_url.url, '=\d{15,}', '[a-z]+%[a-z]{4,}')
12            or any([ml.link_analysis(., mode="aggressive")],
13                   // CF Turnstile
14                   any(.unique_urls_accessed,
15                       .domain.domain == "challenges.cloudflare.com"
16                   )
17                   // or site is down behind Cloudflare
18                   or (
19                     regex.icontains(.final_dom.display_text,
20                                     'error\s*(?:code\s*)?(?:5\d{2}|1\d{3})'
21                     )
22                     and regex.icontains(.final_dom.display_text, 'cloudflare')
23                   )
24            )
25          )
26  )  
27attack_types:
28  - "Credential Phishing"
29tactics_and_techniques:
30  - "Evasion"
31  - "Social engineering"
32detection_methods:
33  - "URL analysis"
34  - "Content analysis"
35  - "Sender analysis"
36id: "fca5ddba-df52-546f-9683-6800f5d23fff"
to-top