Mir0Auth PDF lure followed by browser visit to DocuSign-spoofed page and C2 path
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Microsoft Sentinel (KQL)
