This rule detects a common credential phishing vector enticing the user to engage with links under the premise that they have a voicemail to retrieve. The rule ensures at least a single link is present with either voicemail in the display name, body, subject or a combination of those elements with a medium to high credential theft NLU Intent from a first-time sender.

The body contains a link to a domain with Punycode characters to hide the true URL destination, or contains non-printable ASCII content.

An email from Sharepoint Online that was sent to multiple recipients that did not originate from a sender, by display name, in your organization.