EXPLORE
Sign In
← Back to Explore
sublimemediumRule

Headers: Zimbra mailer from a non-supported OS version

Detects Zimbra originated emails sent from non-supported Windows versions. Observed in widespread HTML credential phishing campaigns.

Detection Query

type.inbound
and strings.starts_with(headers.mailer, "Zimbra")
and regex.icontains(headers.mailer, '\b(5\.1|6\.1)\.\d{4}\b')

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

email
Raw Content
name: "Headers: Zimbra mailer from a non-supported OS version"
description: |
  Detects Zimbra originated emails sent from non-supported Windows versions. 
  Observed in widespread HTML credential phishing campaigns.
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.starts_with(headers.mailer, "Zimbra")
  and regex.icontains(headers.mailer, '\b(5\.1|6\.1)\.\d{4}\b')
detection_methods:
  - "Header analysis"
id: "d23e694f-a23d-5730-9a04-29629f2e6696"