Free-mail sender relayed via spoofed trinity-msg-rest-gmx-mailcom-live infra
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
Microsoft Sentinel (KQL)
