Phishing lure requesting SMS/WhatsApp contact pivot to evade email security
This rule detects incoming emails containing suspicious lures, specifically those soliciting contact via WhatsApp, SMS, or phone calls. By analyzing the email body for keywords associated with off-platform communication (e.g., 'WhatsApp', 'call me', 'reach me at') alongside indicators that a message attachment was present, this detection identifies potential phishing attempts aiming to move targets to a less monitored or more trusted communication channel to facilitate credential harvesting or social engineering.
Microsoft Sentinel (KQL)
