This rule detects inbound messages routed through Microsoft's messaging infrastructure that contain links referencing the recipient's own domain in the URL and that are routed through a Cloudflare Turnstile challenge. It aims to identify phishing attempts designed to bypass automated scanners while delivering the final payload to human victims. Detection relies on: sender.domain == messaging.microsoft.com; message body links excluding mailto; the link URL containing the recipient's domain; and evidence that the final URL chain accesses Cloudflare Turnstile (challenges.cloudflare.com) via aggressive link analysis. The rule is high severity, classified as Credential Phishing, and employs URL analysis, content analysis, and sender analysis as detection methods.