BEC email requesting wire-transfer or payment redirection under invoice pretext
This rule detects incoming emails with subject lines containing keywords associated with invoice, payment, or banking detail changes. These patterns are highly characteristic of Business Email Compromise (BEC) and social engineering campaigns designed to redirect financial transactions to fraudulent accounts.
Microsoft Sentinel (KQL)
