Email bombing burst to a single mailbox followed by external Teams chat

ills3c Intel&Coffee@Ills3C

•updated yesterday•8•0•25

Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.