Fake quarantine email linking to URL carrying victim address (Forg365 lure)
Detects inbound quarantine-themed emails where the embedded URL contains the recipient's email address (either plain or URL-encoded), combined with optional user click events, potentially indicating a targeted phishing attempt.
Microsoft Sentinel (KQL)
