Internal Mailbox Sending Phishing to Multiple Employees
Detects an internal/compromised mailbox sending phishing-style email to multiple employees, the technique CISA's red team used to gain initial workstation access via a trusted internal sender.
Microsoft Sentinel (KQL)
