Executive impersonation phishing via lookalike service-nowinc[.]com domain
This rule detects potential phishing or email spoofing attempts that impersonate ServiceNow or utilize suspicious reply-to domains. It looks for emails sent from service-nowinc.com or specific accounts, and correlates them with email headers containing unusual ReplyToDomain fields such as 'domainlify.net'.
Microsoft Sentinel (KQL)
