EXPLORE DETECTIONS
Attachment: TAR file with RAR type
Detects messages with TAR file extensions that are actually RAR file types. This mismatch between file extension and actual file type may indicate an evasion technique.
Attachment: Targeted DOCX with personalized recipient acknowledgement lure
Detects inbound messages with a DOCX attachment containing a quarterly date reference, specific STATUS and ACKNOWLEDGEMENT formatting patterns, and a personalized salutation where the recipient's name or local email part is dynamically embedded in the document XML.
Attachment: Uncommon compressed file
Use if passing compressed or archive files is not typical behavior in your organization. This behavior has been observed in a number of phishing campaigns.
Attachment: USDA bid invitation impersonation
Detects messages claiming to be from USDA containing bid invitations with macro-enabled attachments or PDFs. Validates USDA-related content through OCR and natural language analysis.
Attachment: Web files with suspicious comments
Detects HTML or SVG files under 100KB that contain duplicate or padding text in the form of literary quotes or common sayings within code comments.
Attachment: WinRAR CVE-2025-8088 exploitation
Detects attempts to exploit CVE-2025-8088 via attached RAR files
Attachment: Word document with hyperlink and fraud language
Detects inbound messages sent from free email providers with an empty subject line and body that carry a Word document (doc/docx) attachment. The attachment is inspected for embedded HYPERLINK field codes containing valid URLs, and its extracted text is passed through an NLU classifier to identify credential theft or advance fee fraud intent, indicating a socially engineered attack hidden inside the document.
Attachment: XLS with legal confidentiality disclaimer
Detects inbound emails with XLS attachments containing a specific legal confidentiality disclaimer string commonly found in corporate email signatures. This pattern may indicate a malicious spreadsheet crafted to appear as a legitimate forwarded business communication, lending false credibility to the attachment.
Attachment: XLSX file with suspicious print titles metadata
Detects XLSX attachments containing EXIF metadata with suspicious TitlesOfParts fields that follow a specific pattern combining 'Company_Name' with extracted values and 'Print_Titles', potentially indicating malicious document preparation.
Attachment: ZIP containing Office binary with embedded DLL
Detects inbound messages with a ZIP attachment that contains an office binary and an unknown DLL.
Attachment: Zip exploiting CVE-2023-38831 (unsolicited)
A Zip attachment that exhibits attributes required to exploit CVE-2023-38831, a vulnerability in WinRAR (prior to 6.23).
Attachment: ZIP file with CVE-2026-0866 exploit
Detects ZIP attachments containing exploits targeting CVE-2026-0866 vulnerability through YARA signature matching.
Attachment: ZIP filename mismatch
Detects inbound messages with ZIP attachments that exhibit a mismatch between the filename stored in the local file header and the filename in the central directory.
Attack Score Flash: Advanced Graymail Detection
Exercises the beta.attack_score_flash() function. Flags on Graymail verdicts.
BEC with unusual reply-to or return-path mismatch
Detects an unusual header mismatch where the sender is not a freemail address, but the reply-to or return-path are. NLU also detects a BEC intent with medium or high confidence.
BEC: Employee impersonation with subject manipulation
Subject matches the display name of someone in your organization, and the body resembles a BEC attack.
BEC: Executive coaching vendor impersonation
Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals.
BEC: Financial fraud from newly registered sender domain
Detects inbound messages from domains registered less than 30 days ago that exhibit business email compromise intent with high-confidence financial or payment topics. The message must also contain explicit banking details such as account and routing numbers, invoice references, or payment urgency language, and must either fail DMARC on a trusted domain or originate from an untrusted domain.
BEC: Tax document request
Detects messages requesting W-2 tax documents or related tax information that exhibit authentication failures such as DMARC or SPF failures, or mismatched reply-to addresses. The rule identifies senders using common administrative local parts and filters for messages containing W-2 language combined with request entities detected through natural language processing.
BEC: Wealth management lure from newly registered domain
Detects inbound messages sent from domains registered within the last 90 days that reference wealth management, estate planning, or offshore financial themes such as Luxembourg or licensed intermediaries. The rule combine these thematic keyword matches with an NLU classifier that flags advance fee or business email compromise intent, surfacing messages that closely resemble financial fraud or advance-fee scams.
BEC/Fraud: B2B sales inquiry cold outreach lure
Detects inbound plain-text messages that mimic sales inquiries or project discussion requests, using language referencing sales teams, project requirements, and procurement officers to establish false business legitimacy. An NLU classifier confirms the message content aligns with B2B cold outreach or purchase order themes, a common pretext used to initiate contact before pivoting to fraudulent business proposals or follow-on scams.
BEC/Fraud: Contract or order lure with mismatched reply-to
Detects inbound messages where the reply-to address differs from the sender's address, while the subject line references a contract agreement or order with an 8-digit numeric identifier and the body text mentions an attached contract or order. This combination is a common tactic in business email compromise attempts designed to redirect replies to an attacker-controlled address.
BEC/Fraud: Fake investment outreach from suspicious TLD
Detects unsolicited investment/funding outreach emails from suspicious TLDs. Targets mass-mailed spam campaigns offering business funding, capital allocation, and family office outreach.
BEC/Fraud: Generic scam attempt to undisclosed recipients
Detects potential generic scams by analyzing text within the email body and other suspicious signals.