SearchLeak P2P Injection via M365 Copilot Search q= Parameter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•6

Detects Parameter-to-Prompt (P2P) injection attempts targeting Microsoft 365 Copilot by identifying suspicious patterns in URL query parameters. The rule monitors AuditLogs for queries containing HTML tags, encoded payloads, or known malicious markers typical of prompt injection exploits against search functionalities (CVE-2026-42824).