Phishing for Info: Spoofed Exec/IT Sender, Auth Fail, Fan-out
Detects high-volume internal email campaigns that exhibit characteristics of phishing, specifically utilizing sender display name impersonation of executive or IT support roles, urgent subject lines, and URLs identified as malicious by threat intelligence. The rule tracks common attributes like SPF/DKIM/DMARC failures and rapid delivery to multiple recipients.
Microsoft Sentinel (KQL)
