Extortion email with TOX contact and 72-hour leak deadline
Detects incoming or outgoing emails with subject lines containing keywords associated with extortion, data leaks, or data breaches, specifically when accompanied by email attachments.
Microsoft Sentinel (KQL)

