AI-Obfuscated Phishing - High-Entropy AI Subdomain Connections
This rule detects potential AI-obfuscated phishing attempts by correlating the launch of a local HTML file (likely from an email attachment or download) with immediate network connections to highly randomized or AI-generated subdomains. These subdomains are often used to host Adversary-in-The-Middle (AiTM) proxies or credential POST endpoints in sophisticated phishing campaigns.
Microsoft Sentinel (KQL)
