Create link_self_sender_doc_lure_external_domain.yml

[MSAdministrator]

Description

Detects self-addressed messages from authenticated business email accounts containing document-sharing language and links to external domains. These messages often indicate compromised account testing where attackers validate phishing infrastructure before targeting external recipients. The combination of DMARC authentication, document lure patterns, external links, and ML-detected credential theft intent suggests an attacker is using a legitimate compromised account to test their phishing campaign.

Associated samples

• OG sample

Associated hunts

• Hunt
• initial multi-hunt