Payment/Shared-Folder Phishing Email Linking to /Team_Meets/ Device-Code Lure
This rule detects incoming emails containing specific subject lines related to 'Request for Payment' and 'Shared Folder' that include links to the '/Team_Meets/' path. It flags instances where the sender's domain differs from the domain hosting the embedded link, which is a common indicator of phishing or credential harvesting attempts using domain masquerading.
Cortex XDR
