Spoofed NIPR or Stripe Invoice Phishing
Identifies emails spoofing NIPR, NAIC, or Stripe domains with invoice-related lures that fail authentication. This rule specifically looks for emails where the sender's domain (SenderFromDomain or SenderMailFromDomain) is one of the targeted domains (nipr.com, naic.org, stripe.com), the subject contains keywords like 'invoice' or 'past due', and the email authentication details do not indicate a 'pass'. This combination suggests a phishing attempt leveraging brand impersonation and financial urgency.
Microsoft Sentinel (KQL)
