[IA] - Detect Microsoft Shared File Messages via InternetMessageId odspnotify value
I don't know how many time I suffered malicious actors sharing links via Microsoft services such as SharePoint or other sites manipulating them for phishing, malware, or other malicious purposes. I have seen multiple detections to detect phishing campaigns based on subjects, such as detecting when an email subject ends with “with you” or contains “shared.” However, if the original mailbox is configured in another language, these rules become useless. This change specifying the InternetMessageID value odspnotify and, in addition, specifying the first part of the InternetMessageId, which tells us the action requested or performed by the email—in this case, share. For this detection, I recommend adding your trusted domains, but it is incredibly useful to detect when links from Microsoft systems are shared with your users from unexpected domains.
Microsoft Sentinel (KQL)
