Kali PhaaS Seen Again: Phishing Email/Link Delivery
This rule detects potential phishing activity by correlating email delivery events and URL click events against a set of known malicious domains and suspicious URL paths. It identifies when a user receives an email containing a suspicious link or interacts with such a link, providing visibility into potential credential harvesting or malware delivery attempts.
Microsoft Sentinel (KQL)
