Phishing Series 2026: Callback Phishing (TOAD) — Invoice Lure to Remote-Access-Tool Install
Detects potential callback phishing (Telephone-Oriented Attack Delivery) by correlating phishing-themed emails containing phone numbers with no hyperlinks to the subsequent execution or installation of common remote monitoring and management (RMM) software on the same host within a six-hour window. The rule further refines this by ensuring the RMM tool was not previously installed on the user's system.
Microsoft Sentinel (KQL)
