DocuSign-themed phishing email with .ics invite to MS OAuth link
Detects phishing emails that impersonate DocuSign by containing both an .ics calendar file attachment and a link directing users to the Microsoft login OAuth authorization endpoint, often indicative of credential or token harvesting.
Microsoft Sentinel (KQL)
