Phantom Deal: Corroborated Advance-Retainer Wire to New HK Beneficiary
Detects anomalous, high-value wire transfers involving keywords related to advance-payment or M&A-related fraud (e.g., 'advance retainer'), directed towards beneficiaries in Hong Kong using previously unseen bank accounts. The rule effectively filters out known, approved beneficiary accounts to focus on potentially malicious transactions.
Microsoft Sentinel (KQL)
