[IC] - Catching emojis on email Subjects
Marketing emails use Emojis all the time… but attackers use them too because they catch attention and increase the chance someone clicks: - ⚠️ Urgent messages - 📦 Delivery notifications - 📄 Fake invoices - 🔐 Password resets Identify and classify cases on Email Subjects can be converted in useful detections. It query identify: - Emails received with icons in the subject - Where the URL was clicked - Excluding cases where the sender is added as allowed either in the organization or user level - Summarise by number of Emails, number of distinct recipients and also identify if the messages were delivered into Inbox Folders
Microsoft Sentinel (KQL)
