Skip to content

Update impersonation_sharepoint_body_credential_theft.yml - #4982

Open
markmsublime wants to merge 2 commits into
mainfrom
markmsublime.fp.na.sharepoint_impersonation
Open

Update impersonation_sharepoint_body_credential_theft.yml#4982
markmsublime wants to merge 2 commits into
mainfrom
markmsublime.fp.na.sharepoint_impersonation

Conversation

@markmsublime

@markmsublime markmsublime commented Jul 29, 2026

Copy link
Copy Markdown
Member

Description

adding OneDrive to the body links check to negate legitimate Microsoft shares. this is already coupled with the message ID format verifying it is SP/OD

Associated samples

Associated hunts

  • Hunt 1 - messages that will be negated

@markmsublime
markmsublime requested a review from a team July 29, 2026 22:11
@markmsublime
markmsublime requested a review from a team as a code owner July 29, 2026 22:11
github-actions Bot added a commit that referenced this pull request Jul 29, 2026
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant