Threat Hunting via InternetMessageId (+ KQL Queries)

This report provides practical threat-hunting guidance and KQL queries for Microsoft EmailEvents that parse InternetMessageId values (notably 'odspnotify' and OneTimePasscode patterns) to detect suspicious email behaviors such as unexpected external sharing, forwarding, or language-agnostic notifications; it presents multiple hypotheses, parsing methods, and example detections to improve email-focused threat detection and investigation.