High-Impact Phishing Campaign Detected (≥25 Recipients in 48h)
Detects high-impact phishing campaigns identified by Microsoft Defender for Office 365. Alerts when a campaign (CampaignName, CampaignId) targets 25 or more recipients (RecipientEmailAddress) within 48 hours, providing timestamp and message details (NetworkMessageId) for investigation.
Microsoft Sentinel (KQL)
