AI-Obfuscated Phishing - Rapid Attachment Polymorphism
This rule detects AI-generated phishing campaigns characterized by a high degree of attachment polymorphism. It identifies instances where a single campaign (based on sender domain or subject schema) delivers HTML attachments with a unique SHA256 hash to each recipient, indicating an attempt to evade traditional signature-based detection.
Microsoft Sentinel (KQL)
