Email Bombing Spike to Single Mailbox Preceding Vishing Call
Detects high-volume email inflow to a single recipient mailbox within a 15-minute timeframe. The rule specifically monitors for subject lines commonly associated with subscription confirmations or newsletters, indicating a potential email bombing or mail flood attack designed to overwhelm a user's inbox or hide malicious communications.
Sigma
