Suspicious Randomized Jira Subdomains
Detects potential spam campaigns originating from disposable or trial Jira Cloud instances with randomized subdomain names. The rule identifies emails from '.atlassian.net' domains where the subdomain is longer than 12 characters and contains a mix of letters and numbers, indicating a potentially randomized or disposable instance. It then alerts if more than 5 emails with the same subject are sent from such a suspicious subdomain.
Microsoft Sentinel (KQL)
