Inbound e-card phishing from first-time Gmail sender impersonating branded notification
Detects inbound emails originating from a gmail.com sender that have not previously communicated with the recipient in the last 90 days. The rule identifies emails containing e-card or greeting card-themed subjects, which are often used as social engineering lures to masquerade as automated branded notifications for malicious activity or credential theft.
Microsoft Sentinel (KQL)
