M365 Copilot Search P2P Injection (SearchLeak)
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824). Specifically looks for HTML image tags (<img src=), the variable '$TITLE', or the Bing SSRF endpoint 'bing.com/images/searchbyimage' within the URL-decoded 'q' parameter.
Microsoft Sentinel (KQL)
