Threat Hunt: Direct Send Spoofing Exploit Detection
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
Microsoft Sentinel (KQL)
