Detect inbound messages from Microsoft's legitimate alert infrastructure (messaging.microsoft.com or office365alerts@microsoft.com) that carry cross-tenant headers and include at least one URL in the body. The rule requires a cross-tenant header (X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp) present in any header field and at least one non-mailto link in body.current_thread.links. It explicitly excludes known legitimate Purview encryption links and links to Purview or security portals, as well as messages with rpmsg attachments (rpmsg files or application/x-microsoft-rpmsg-message). This combination aims to identify abuse of trusted Microsoft channels to deliver suspicious links across tenants (out-of-band pivot via a trusted infrastructure) rather than ordinary notifications. Detection methods include header analysis, sender verification, and URL analysis. Potential telemetry includes inbound email traffic characteristics, sender domain checks, and link domains. Recommended triage includes validating the sender’s legitimacy, inspecting the linked URLs in a safe environment, and applying tenant controls to mitigate cross-tenant abuse of trusted channels.