SearchLeak CVE-2026-42824 Copilot P2P Injection to Bing SSRF Exfil Chain
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
YARA-L
