• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Internal spearphishing email requesting direct deposit change (Storm-2755 BEC)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated 22 days ago•0•0•2

    Detects internal spearphishing emails containing subjects and body text commonly associated with payroll fraud, specifically attempts to solicit changes to employee direct deposit accounts by requesting voided checks or information about upcoming payments.

    Sigma

    Tags

    T1598.002 - Spearphishing AttachmentT1598.003 - Spearphishing LinkT1657 - Financial TheftTA0043 - ReconnaissanceTA0040 - ImpactEmail Phishing DetectedApplication EventOffice 365M365 Unified Audit Log

    Found in

    • Storm-2755 AiTM Phishing and Payroll Fraud CampaignLast updated Aug 10, 2026
    • Storm-2755 Payroll Pirates AitM Phishing CampaignLast updated Aug 9, 2026
    • Storm-2755 Payroll Pirate Campaign Targeting Canadian EmployeesLast updated Apr 16, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?