High Severity

Attachment: Suspicious Office 365 app authorization (OAuth) link

Labels

Description

Detects inbound messages whose PDF, HTML, DOCX, or PPTX attachments contain a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account. ICS and EML attachments are covered by separate rules.

References

https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset

Sublime Security

Created Sep 28th, 2026 • Last updated Oct 14th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(attachments, .file_type in ("pdf", "html", "docx", "pptx")),
        any(file.explode(.),
            any(.scan.url.urls,
                (
                  .domain.domain in (
                    'login.microsoftonline.com',
                    'login.microsoft.com'
                  )
                  or strings.icontains(.query_params,
                                       "login.microsoftonline.com",
                                       'login.microsoft.com'
                  )
                )
                and (
                  strings.ilike(.query_params,
                                '*offline_access*',
                                '*.readwrite*',
                                '*.read*',
                                '*ctx=*',
                                '*prompt=none*'
                  )
                  or (
                    strings.icontains(.path, '/common/reprocess')
                    and strings.icontains(.query_params, 'ctx=')
                    and strings.icontains(.query_params, 'sessionId=')
                  )
                )
            )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.