Medium Severity

Link: Self-service platform link to Microsoft login redirect

Labels

Credential Phishing

Open redirect

Description

Detects inbound emails containing links to self-service creation platforms that lead to a final destination page embedding links to Microsoft login domains with OAuth or session parameters such as offline_access, read/write scopes, ctx, or sessionId. This pattern is indicative of abuse of legitimate hosting services to stage credential or consent phishing pages that redirect victims to Microsoft authentication flows.

References

No references.

Sublime Security

Created Oct 14th, 2026 • Last updated Oct 14th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  any(body.current_thread.links,
      (
        .href_url.domain.root_domain in $self_service_creation_platform_domains
        or .href_url.domain.domain in $self_service_creation_platform_domains
      )
      and any(ml.link_analysis(.).final_dom.links,
              (
                .href_url.domain.domain in (
                  'login.microsoftonline.com',
                  'login.microsoft.com'
                )
                or strings.icontains(.href_url.query_params,
                                     "login.microsoftonline.com",
                                     'login.microsoft.com'
                )
              )
              and (
                strings.ilike(.href_url.query_params,
                              '*offline_access*',
                              '*.readwrite*',
                              '*.read*',
                              '*ctx=*',
                              '*prompt=none*'
                )
                or (
                  (
                    strings.icontains(.href_url.path, '/common/reprocess')
                    or strings.icontains(.href_url.query_params,
                                         "/common/reprocess"
                    )
                  )
                  and strings.icontains(.href_url.query_params, 'ctx=')
                  and strings.icontains(.href_url.query_params, 'sessionId=')
                )
              )
      )
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.