Delivered Phishing Email with Matching Subject Prefix and Attachment Name
Detects delivered emails where the subject line matches a specific pattern (five digits followed by a hyphen and text) and the attachment filename corresponds to the extracted subject text, ending with 'Document.xlsx', and the email was not quarantined post-delivery.
Microsoft Sentinel (KQL)
