SearchLeak Copilot Search P2P Injection Link Delivered via Email or Messaging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potentially malicious search queries within Microsoft 365 or Copilot-related URLs intercepted by email gateways, proxies, or SIEM sources. It monitors for suspicious query parameters that may indicate attempts to hide malicious content, such as HTML tags (e.g., <img>), image-related keywords, or excessively long query strings, which could be indicative of phishing attempts or browser-based exploitation techniques.