FIFA Themed Credential Phishing from New Mail Sender
This rule flags FIFA-related phishing emails from senders your organisation has never received mail from before. New senders plus urgent sports language is a common fraud pattern. Use multi-factor authentication on mail-linked accounts. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
