AI-generated mass invoice phishing with template artifacts
This rule detects high volumes of inbound emails from a single domain that contain attachments and URLs, specifically filtering for finance-related subjects such as invoices, payments, or balance inquiries. Such patterns are commonly associated with large-scale phishing or business email compromise (BEC) campaigns.
Microsoft Sentinel (KQL)
