Google Forms /edit?invite= Phishing via Legitimate Google Infrastructure
This rule detects potentially unauthorized or suspicious Google Forms collaboration invitations delivered via email. It filters for emails that pass full sender authentication (SPF, DKIM, and DMARC) and originate from Google infrastructure, while containing a specific Google Forms editor invite URL pattern. The rule excludes internal organizational communications from the Google domain and identifies specific return-path domains commonly associated with automated Google Forms sharing notifications to highlight external or unexpected collaboration requests.
Microsoft Sentinel (KQL)
