BEC: Exec Impersonation + Urgent Wire/Payroll/Gift-Card Request
This rule detects potential Business Email Compromise (BEC) attempts where external senders impersonate corporate executives (e.g., CEO, CFO) by spoofing display names or using lookalike/cousin domains. It triggers when these impersonations are combined with urgent, financial-themed language in the email subject line (e.g., wire transfers, payroll changes, or gift card requests).
Microsoft Sentinel (KQL)
