Phishing lure emails advertising ~65% discounts linking to .shop domains
Detects high-volume, potentially malicious email campaigns characterized by discount-themed subject lines containing keywords like '65% off' and links pointing to '.shop' domains. The rule identifies suspicious patterns by aggregating events and flagging instances where multiple users are targeted with similar subjects and domains, excluding those specifically allowlisted.
Microsoft Sentinel (KQL)
