Microsoft Forms link abused as open redirector in Kratos phishing lure
This rule detects potential phishing attempts by identifying emails that contain links to legitimate Microsoft Forms (forms.office.com) with lures commonly associated with document-related phishing (e.g., 'shared a document', 'invoice'). The rule then correlates this with user click activity to identify instances where the user was redirected from the Microsoft Forms site to an external, potentially malicious URL.
Microsoft Sentinel (KQL)
