Safe Links wrapper decoding to credential-harvesting /js landing path
Detects Outlook Safe Links redirector URLs that decode to a destination path ending in /js, consistent with a credential-harvesting landing page hosted on a compromised or bystander third-party domain behind the CTA link.
Microsoft Sentinel (KQL)
