Unauthorized DKIM/SPF DNS record addition (Resend/SES selector) in org DNS zone
This rule detects the addition of TXT or CNAME records within Azure-managed DNS zones that correspond to third-party email sending platforms, specifically Amazon SES or Resend. It monitors for the creation of DKIM selectors or SPF records that authorize these services to send emails on behalf of the organization's domain, which can be used to facilitate email spoofing or phishing.
Microsoft Sentinel (KQL)
