Scotiabank TOAD Phishing: SPF/DMARC Pass with Display Name Mismatch
Detects email-based phishing attempts impersonating Scotiabank where the sender display name contains 'Scotiabank' but the actual sending domain is not 'scotiabank.com'. The rule specifically looks for emails with SPF and DMARC pass but missing DKIM pass, combined with suspicious subject lines (e.g., 'interac', 'e-transfer', 'unauthorized') or specific IP addresses/GoDaddy infrastructure indicators, and targeting high-value recipients (CFO, finance, etc.). This pattern is consistent with compromised legitimate small-business domain abuse.
Microsoft Sentinel (KQL)
