Built-in Account Login Followed by Internal Mail Send (Default Creds Abuse)
Detects authentication to a web application using default/built-in account credentials followed by outbound mail sent from an internal address — the technique CISA's red team used to send phishing email from a trusted internal identity.
Microsoft Sentinel (KQL)
