Top AI 2026 | MITRE ATLAS Mapped AML.T0052 – LLM-Powered Spearphishing & Synthetic Social Engineering (AML-DET-020)
This rule detects a multi-stage attack correlation where a user receives multiple inbound emails flagged for high likelihood of being LLM-generated (and containing urgency/credential-harvesting language) and subsequently performs a voice or video authentication attempt that is flagged by deepfake detection systems with a low confidence score, indicating a potential impersonation attempt.
YARA-L
