Detect Microsoft Domain Spoofing in Inbound Emails
This rule detects inbound emails where the sender's domain contains "microsoft" but does not end with "microsoft.com". This is a common tactic used in phishing attacks to spoof legitimate Microsoft domains, tricking recipients into believing the email is from a trusted source.
Microsoft Sentinel (KQL)
