EXPLORE DETECTIONS
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
Detects potential job scams using plaintext or fake threads attempting to pivot to a freemail address from an unsolicited sender.
BEC/Fraud: Penpal scam
This rule detects messages from individuals looking to establish contact under the guise of seeking friendship or a penpal relationship. Over time, they build trust and then exploit this relationship by asking for money, personal information, or involvement in suspicious activities.
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
Detects suspicious reply messages with urgent language in sender name or email address, minimal body content, and the sender's email address appearing in previous thread content, indicating a self reply.
BEC/Fraud: Romance scam
This rule detects messages attempting to initiate a Romance scam. The rule leverage tells such as undisclosed recipients, freemail emails in the body and common scam phrasing. Romance scams are deceptive schemes where scammers establish false romantic intentions towards individuals to gain their trust and eventually exploit them financially.
BEC/Fraud: Scam lure with freemail pivot
This message detects BEC/Fraud lures attempting to solicit the victim to pivot out of band via a freemail address in the body.
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread
Flags messages where the sender appears to be replying to themselves within an established thread, but the first non-mailto link in the current message points to a domain unrelated to the sender and to any links seen in the previous thread history (accounting for Mimecast link wrapping). The rule confirms the sender was a genuine participant in prior thread messages and that no organizational recipients or domain matches exist in the earlier history, indicating a likely compromised external account being used to redirect the conversation via a newly introduced, unrelated link.
BEC/Fraud: Student loan callback phishing
This rule detects phishing emails that attempt to engage the recipient by soliciting a callback under the guise of student loan forgiveness or assistance. The messages often come from free email providers, lack a proper HTML structure, and include suspicious indicators such as phone numbers embedded in the text. These emails typically contain language urging the recipient to respond or take immediate action, leveraging urgency around student loan repayment to entice engagement.
BEC/Fraud: Unsolicited business acquisition offer
Detects inbound messages with subjects referencing an offer to purchase, combined with body content mentioning private equity, acquiring companies, or discussing an opportunity. These messages are characteristic of fraudulent or unsolicited business acquisition solicitations designed to engage targets in fraudulent financial dealings.
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
Identifies inbound messages using urgent language patterns and sender behavioral traits common in social manipulation. Combines multiple indicators including urgent subject lines, characteristic message content, short message length, and suspicious sender attributes.
Benefits enrollment impersonation
Detects messages about benefit enrollment periods and healthcare selections from external senders that contain urgent language or requests for action. Excludes legitimate HR communications, marketing mailers, and trusted sender domains with valid authentication.
Body HTML: Comment with 24-character hex token
Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes.
Body HTML: Recipient SLD in HTML class
Detects when there is a single recipient within $org_domains where the domain SLD is concealed within HTML class attributes. The message comes from either an unauthenticated trusted sender or an untrusted source.
Body: AI-generated invoice template artifacts
Flags inbound messages where NLU classification of the thread text indicates medium or high confidence credential theft or BEC intent, and the message HTML contains comment artifacts characteristic of AI-generated invoice/billing templates (e.g. 'PDF icon', 'File row', 'Billing Table', 'CTA Button'). Messages from highly trusted sender domains are excluded unless they fail DMARC authentication.
Body: Bid solicitation PDF lure
Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure.
Body: CSS clamp() font obfuscation
Detects inbound messages where the HTML body (including HTML content within .eml attachments) uses CSS clamp() with a font-size or line-height minimum bound of zero or a negative value. This technique renders text invisible or unreadable to recipients while remaining present in the underlying markup, a method commonly used to hide malicious content or evade text-based detection engines.
Body: CSS Hidden text via clip-path
Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body.
Body: CSS Hidden text via table-column
Detects inbound messages containing elements styled with 'display: table-column' combined with a height or width of zero, effectively hiding the element from visual rendering. The rule flags cases where the hidden element contains more than 100 non-whitespace characters of inner text, a technique commonly used to conceal content from human recipients while still embedding it in the DOM to evade text-based or visual detection systems.
Body: CSS zero-value calc() obfuscation
Detects inbound messages containing HTML where a CSS calc() expression subtracts an identical value and unit from itself (e.g., calc(100px - 100px)), always resolving to zero. This pattern is commonly used to hide or collapse content from view while keeping it present in the underlying HTML, a technique often leveraged to evade text-based detection or conceal malicious content from recipients.
Body: CVE-2026-42897 Exchange OWA stored XSS
Detects messages exploiting CVE-2026-42897, a stored XSS vulnerability in on-premises Exchange Outlook Web Access (OWA). The exploit embeds Base64-encoded JavaScript payload fragments after URL fragment identifiers (#) within data URI image src attributes, with a malformed img tag onload/onerror handler that reassembles and executes the fragments via eval(atob(...)). Detection covers both the delivery technique (img tags with event handlers combined with base64 data after # fragments) and implant content (OWAReaper-specific function names and API calls decoded from base64 within img tag src attributes). Simply opening the message in OWA's reading pane can trigger execution.
Body: Embedded email headers indicative of thread hijacking/abuse
Detects email headers embedded in the message body content, indicating forwarded phishing attempts, MIME boundary manipulation, delivery notification spoofing, or copy-paste phishing. This pattern is commonly seen when attackers forward legitimate emails and the headers get included in the body, or when spoofing system notifications.
Body: Fake secure email portal with HTML obfuscation
Detects inbound messages with empty subjects impersonating a secure email portal, identified through multiple indicators including hidden HTML characters used to obfuscate the sender address, recipient domain echoed back as a portal sender, template typos, or frozen tracking links associated with known secure messaging infrastructure abuse.
Body: HTML whitespace stuffing with short initial message
Detects messages that uses HTML-based whitespace padding (repeated br tags, p-nbsp blocks, or div-br wrappers) to push content below the visible fold.
Body: Invisible Unicode obfuscation student loan callback phishing
Detects messages containing clusters of Unicode zero-width and invisible characters (such as LRM, RLM, zero-width space, BOM, and directional isolates) interspersed within digit sequences and body content matching 'student loan' patterns. This technique is used to obscure text from security filters while remaining visually coherent to recipients.
Body: PayApp transaction reference pattern
Detects messages containing PayApp transaction reference numbers in a specific format (PayApp# followed by digits) in either the message body or subject line.