Authenticated Code-of-Conduct Email from a Newly Observed Sender Domain
Detects inbound emails that are fully authenticated (SPF, DKIM, DMARC pass) and contain keywords related to 'code of conduct', 'employee handbook', 'policy acknowledgement', or 'compliance update' in the subject line, originating from a sender domain that has not been observed by the recipient organization within the last 24 hours. This rule aims to identify potential phishing attempts leveraging social engineering themes from newly registered or previously unseen domains.
Splunk (SPL)
