DoppelBrand Burst mass-mail campaign via third-party ESP with SPF/DKIM misalignment
This rule detects high-volume email bursts sent through third-party bulk email providers where the sender domain exhibits SPF, DKIM, or DMARC alignment failures. This behavior is indicative of mass phishing campaigns, such as those associated with 'Operation DoppelBrand', attempting to bypass email authentication defenses using compromised or unauthorized infrastructure.
Microsoft Sentinel (KQL)
