Spoofed helpdesk caller ID corroborated by carrier mismatch or recipient report
Detects inbound voice calls that spoof corporate helpdesk numbers. The rule triggers when an incoming call from an external/PSTN trunk matches a known helpdesk number and exhibits signs of spoofing, specifically either a mismatch between the current call's carrier and historical baseline carrier for that number, or a report by the recipient that the call was suspicious.
Microsoft Sentinel (KQL)
