Invoice Lure Email Linking to SharePoint-Hosted .url Shortcut File
Detects phishing emails that impersonate invoice-related correspondence, containing SharePoint links and a .url shortcut file attachment, a common technique for credential harvesting or malware delivery.
Sigma

