Suspicious Email Attachment Detection by Type or Size
This rule identifies suspicious email attachments based on their file type (e.g., executables, scripts) or if they exceed a defined size threshold. It aims to detect potential data exfiltration or the delivery of malicious files via email.
Microsoft Sentinel (KQL)
