Email Communication with Attachments or Forwarding Indicators
This rule identifies email patterns that involve either the presence of email attachments (specifically .eml or .msg files) or common email forwarding/reply indicators (e.g., 'FW:', 'FWD:', 'RE:'). By aggregating emails based on the sender and subject, it provides a summary of communication volume, which can be used to identify anomalous email activity or potential phishing staging/thread hijacking.
Microsoft Sentinel (KQL)
