Duplicate AI-Faceswapped Headshot Image Reused Across Multiple Identity Personas
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
Cortex XDR
