Phishing Series 2026: AI Voice-Clone Vishing Preceding Wire-Transfer Authorization (Deepfake BEC)
Detects potential Business Email Compromise (BEC) fraud involving AI voice-cloning. The rule correlates external or unrecognized Microsoft Teams activity (calls/chats) directed at finance users with high-value financial transactions or vendor bank detail updates occurring on the same day, specifically when these transactions lack evidence of legitimate out-of-band or second-approver verification.
Microsoft Sentinel (KQL)
