Email bombing precursor to IT-support vishing call
This rule monitors email traffic to detect scenarios where a single recipient is receiving a large volume of emails (at least 30 messages) from a high number of unique senders (at least 15) within a one-hour window. This behavior is indicative of a potential bulk spam or phishing campaign targeting a specific mailbox, which may be attempting to overwhelm the recipient or bypass traditional filters through volume.
Microsoft Sentinel (KQL)
