SharePoint Phishing Attacks Using Lick Deceptive Techniques
This detection identifies emails linked to a recent widespread phishing campaign that abuses trusted Microsoft SharePoint links to bypass traditional security controls. Attackers use convincing business emails containing SharePoint URLs that lead to multi-step validation pages, mimicking legitimate Microsoft authentication flows. These techniques make the attacks highly deceptive and harder to detect, as the initial links appear legitimate. This campaign has been active and prevalent over the past two weeks, targeting multiple organizations and leveraging user trust in Microsoft services to harvest credentials. Use this query to find potential malicious SharePoint links in email messages and investigate them further by detonating the URLs in a sandbox environment to analyze their behavior.
Microsoft Sentinel (KQL)
