Opening case…
Loading your run…
Finance received a convincing voice call and email chain impersonating the CFO.
A finance analyst reported a phone call from "the CFO" (matching voice) urgently requesting a $480k wire to a new supplier, reinforced by a spoofed email thread. The analyst paused and escalated. No funds have moved yet.
index=email sourcetype=header | where from_display="CFO Name" AND from_domain!=corp_domain OR reply_to!=corp_domain | table msg_id, from_domain, reply_to, subjectdetection queryindex=email sourcetype=header | where from_display="CFO Name" AND from_domain!=corp_domain OR reply_to!=corp_domain | table msg_id, from_domain, reply_to, subject