Google Forms /edit?invite= Phishing via Authenticated Google Infrastructure
This rule detects potentially malicious email messages masquerading as Google Forms collaboration invitations. It identifies emails originating from Google-related domains that contain URLs for Google Forms with invite parameters. The detection logic filters for messages passing SPF, DKIM, and DMARC authentication checks to highlight legitimate-looking emails that may be part of a social engineering campaign, and flags instances where the sender's display name matches the recipient's name as a high-risk indicator of impersonation.
Microsoft Sentinel (KQL)
