Hunt ServiceNow Invoice-Fraud AI Impersonation Campaign

Ankit Mehta@Secvyn

•updated Sep 11, 2026•0•0•2

This rule monitors email traffic for communication involving identified malicious domains and sender addresses. It cross-references sender information in the EmailEvents log with a predefined set of suspicious domains and email addresses, highlighting potential phishing or malicious outreach attempts.