Detecting Phishing with Microsoft Email Headers
I also wrote a companion post on the Sublime Security blog: Getting started with Microsoft email headers for security. It covers these headers with hunts written for Sublime’s MQL. A copy of the original post is archived at the bottom of this page.
Original Post: Getting started with Microsoft email headers for security
Originally published August 27, 2026 on the Sublime Security blog. Archived here in case the original is removed.
Whether you’re a SOC analyst or a detection engineer, understanding Microsoft email infrastructure is advantageous for investigating and resolving email-based threats. If you’re working at a Microsoft shop, you may have already seen Microsoft’s recent Phishing actors exploit complex routing and misconfigurations to spoof domains blog. That post gives a great overview of how adversaries are taking advantage of misconfigurations that can happen when a SEG (secure email gateway) is placed in front of Microsoft, as we can see from this line:
Continue reading