Suspicious Inbound Email from onmicrosoft.com Tenant
Detects inbound email delivered from external Microsoft 365 tenants (@*.onmicrosoft.com) which may be attempting to impersonate legitimate senders. Threat actors register disposable or lookalike M365 tenants to abuse Microsoft's native SPF/DKIM authentication and bypass email security controls.
Microsoft Sentinel (KQL)
