BRE Phishing: Cloud Platform Redirect Chain in Email URLs
This rule identifies phishing emails containing multiple distinct redirect hops across various cloud hosting platforms (e.g., Azure Websites, Firebase, CloudFront). It flags emails as suspicious if they contain URLs from multiple monitored cloud platforms, indicating a likely bulletproof redirect chain, and correlates these emails with click data. It elevates the severity for emails sent to privileged user accounts such as admins, executives, or finance staff.
Microsoft Sentinel (KQL)
