DoppelBrand BEC: Urgent ACH/Wire Redirect with Amount or Reply-To Mismatch
Detects incoming emails to finance or accounts payable aliases that contain urgent payment-related keywords and suspicious patterns, such as subject lines including dollar amounts or emails where the Reply-To address domain differs from the Sender domain. This activity is highly indicative of BEC fraud attempts targeting payment redirection.
Microsoft Sentinel (KQL)
