https://letsautomate.it/tags/mql/ Recent content in MQL on Lets Automate It Hugo en-us Thu, 27 Aug 2026 10:00:00 -0500 https://letsautomate.it/article/detecting-phishing-with-microsoft-email-headers/ Thu, 27 Aug 2026 10:00:00 -0500 https://letsautomate.it/article/detecting-phishing-with-microsoft-email-headers/ <blockquote> <p>I also wrote a companion post on the Sublime Security blog: <a href="https://sublime.security/blog/getting-started-with-microsoft-email-headers-for-security/">Getting started with Microsoft email headers for security</a>. It covers these headers with hunts written for Sublime&rsquo;s MQL. A copy of the original post is archived at the bottom of this page.</p> </blockquote> <h2 id="original-post-getting-started-with-microsoft-email-headers-for-security">Original Post: Getting started with Microsoft email headers for security</h2> <p><em>Originally published August 27, 2026 on the <a href="https://sublime.security/blog/getting-started-with-microsoft-email-headers-for-security/">Sublime Security blog</a>. Archived here in case the original is removed.</em></p> <p>Whether you&rsquo;re a SOC analyst or a detection engineer, understanding Microsoft email infrastructure is advantageous for investigating and resolving email-based threats. If you&rsquo;re working at a Microsoft shop, you may have already seen Microsoft&rsquo;s recent <a href="https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/">Phishing actors exploit complex routing and misconfigurations to spoof domains</a> blog. That post gives a great overview of how adversaries are taking advantage of misconfigurations that can happen when a SEG (secure email gateway) is placed in front of Microsoft, as we can see from this line:</p>