SharePoint/OneDrive hosted redirect used to reach Kratos phishing landing page
Detects instances where a user receives an email containing a link to SharePoint or OneDrive, but upon clicking the link, the user is redirected to a different, non-Microsoft domain. This behavior is indicative of a phishing attempt using legitimate file-sharing services to bypass initial URL filtering.
Microsoft Sentinel (KQL)
