M365 RejectDirectSend bypass: null envelope sender with internal From domain
Detects inbound emails where the sender claims to be from an internal or organization domain but has a null envelope sender address, lacks valid DKIM authentication, and does not match common legitimate automated messages (like DSNs or auto-replies), potentially indicating email spoofing or phishing attempts.
Microsoft Sentinel (KQL)
