Payroll Pirate: Internal Lateral Phishing for Payroll Redirection from Compromised M365
This rule detects potential lateral phishing attempts originating from a compromised Microsoft 365 account. It flags outbound internal emails containing payroll-related keywords, such as direct deposit or salary redirection, which are sent to HR or finance departments. This activity is correlated with recent mailbox rule modifications (like transport or inbox rules) by the same user, a technique often used by threat actors to hide communications or exfiltrate data, consistent with identified campaigns like Payroll Pirate.
YARA-L
