DoppelBrand - AI-templated invoice phishing via normalized-subject burst clustering
Detects coordinated email phishing campaigns by normalizing email subjects to identify recurring templates and flagging those sent to a high volume of recipients across multiple organizations within a short timeframe. The rule specifically targets financial and urgent pretexts from external senders, similar to observed techniques in impersonation campaigns.
Microsoft Sentinel (KQL)
