Threat Hunting scenario: Catching emojis on Files and Email Subjects (+ KQL Queries)
ID: 543045ab-b22f-5941-8fff-89737e8f3e79
STIX ID: report--543045ab-b22f-5941-8fff-89737e8f3e79
Feed Name: Detect FYI
Provides a KQL detection technique to surface emails whose subject lines contain emoji characters together with phishing-related keywords (e.g., "urgent", "verify", "invoice"), and cautions that this approach may miss legitimate phishing indicators that use other words or different languages.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.