Google AMP Phishing
This detection looks for emails which include URLs with ‘amp/s’. This is an indicator of Google AMP Phishing which uses legitimate Google domains to redirect to the malicious URLs. When detected this is a high confident sign of phishing.
Microsoft Sentinel (KQL)
