External DM Social Engineering - IT Helpdesk Impersonation or WFH Lure
This rule detects potential social engineering attempts in external direct messages (DMs) by identifying messages that impersonate IT helpdesk or support personnel, or discuss 'working from home' scenarios. It specifically looks for keywords like 'helpdesk', 'help desk', 'IT support', and 'working from home' in the recipient details or sender display name of external messages within the last 5 days. The goal is to surface lures that aim to trick users into revealing sensitive information or performing actions under false pretenses.
Microsoft Sentinel (KQL)
