Email bombing via mass subscription-confirmation spam preceding vishing
Detects a sudden spike in subscription/confirmation-themed emails to a single recipient within a 10-minute window, significantly exceeding that recipient's historical baseline, excluding properly authenticated reputable bulk senders. This pattern is consistent with 'email bombing' used by UNC6692 to overwhelm targets before follow-up vishing/Teams-based IT impersonation social engineering.
Microsoft Sentinel (KQL)
