A rule that detects inbound emails containing links to self-service creation platforms which ultimately redirect to Microsoft login domains hosting OAuth or session-based parameters (offline_access, read/write scopes, ctx, sessionId). The detection correlates the link origin (self-service platform domains) with downstream authentication targets (login.microsoftonline.com or login.microsoft.com) found in the final destination or query parameters. It also looks for OAuth-related indicators or session management cues (offline_access, read/write scopes, ctx, sessionId) and for paths like /common/reprocess that accompany such parameters. This pattern is characteristic of credential-phishing campaigns that abuse legitimate hosting services to stage phishing pages and steer victims through Microsoft authentication flows. The rule employs URL analysis, HTML/content inspection, and open-redirect/social-engineering indicators to identify these chain redirects and credential prompts, aligning with Credential Phishing and Open Redirect techniques, with related detections covering suspicious Office 365 app authorizations.