Candiru lookalike media/Amnesty domains and Spanish government COVID phishing em
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Microsoft Sentinel (KQL)
