Invoice pretext email with no URL or attachment from consumer account
Detects inbound emails originating from consumer email domains with no URLs or attachments, containing invoice-related subjects, which are often used as pretext emails for vishing campaigns.
Microsoft Sentinel (KQL)
