OAuth redirect via login.microsoftonline.com to Teams and cdn.bloom.io
This rule detects potential credential harvesting or phishing attempts by identifying specific URL redirection chains that involve a Microsoft login portal, a Microsoft Teams link, and an external third-party CDN domain (cdn.bloom.io). This pattern is consistent with adversary-in-the-middle or credential phishing campaigns designed to bypass security controls by utilizing trusted services for initial delivery.
Microsoft Sentinel (KQL)
