Forged Healthcare Sender Phishing: DKIM/DMARC Fail with SaaS Redirect
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
Splunk (SPL)
