EXPLORE DETECTIONS
Body: Suspicious date format
Detects messages containing strage date formats observed in phishing emails.
Body: Suspicious table template fingerprint
Detects messages matching a specific HTML template fingerprint characterized by a table containing both 'Important' and 'Company' text nodes. This pattern is associated with a known malicious message template used to deceive recipients.
Body: Yellow highlighted text markers
Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation.
Brand impersonation: AARP
Detects messages impersonating AARP by analyzing sender display name and body content for AARP references, address information, or survey-related language from unauthorized senders.
Brand impersonation: Aconex
Detects messages impersonating Aconex that attempt to steal credentials, identified either through NLU classification of organization/sender entities combined with credential theft intent, or through keyword matching on terms like 'Support Central', 'Mail Number', 'Reference Number', and automated email disclaimers. Excludes messages from trusted Oracle/Aconex domains or other highly trusted sender domains that pass DMARC authentication.
Brand impersonation: Adobe (QR code)
Detects messages using Adobe image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.
Brand impersonation: Adobe Acrobat Sign PDF phishing file format template
Detects specific credential phishing PDF attachments that contain Adobe branding or Adobe Acrobat Sign text along with specific file format indicators, potentially indicating fraudulent documents impersonating legitimate Adobe services.
Brand impersonation: Adobe Sign with suspicious indicators
Detects messages impersonating Adobe Sign that contain Adobe branding elements but are not sent from legitimate Adobe domains and lack proper Adobe Sign authentication headers.
Brand impersonation: Adobe with suspicious language and link
Email contains an Adobe logo, at least one link, and suspicious link language from a new sender.
Brand impersonation: ADP
Impersonation of the payroll provider ADP. Most commonly seen around US tax season (Q1)
Brand impersonation: AliExpress
Detects messages impersonating AliExpress by matching known footer text and social media links, while confirming the sender is not legitimately from AliExpress or its infrastructure.
Brand impersonation: Amazon
Impersonation of Amazon. These are most commonly fake shipping notifications. Amazon is the #2 most-impersonated brand (as of Q2 2020)
Brand impersonation: Amazon Web Services (AWS)
Detects messages impersonating AWS through similar display names combined with security-themed content and authentication failures. Excludes legitimate AWS communications and trusted senders.
Brand impersonation: Amazon with suspicious attachment
Impersonation of Amazon. These are most commonly fake shipping notifications. Amazon is the #2 most-impersonated brand (as of Q2 2020)
Brand impersonation: American Express (AMEX)
Impersonation of the credit card provider American Express.
Brand impersonation: Anthropic/Claude with newly registered domain
Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old).
Brand impersonation: Apple
Impersonation of Apple.
Brand impersonation: Aquent
Detects messages impersonating Aquent, a staffing and talent solutions company, by analyzing sender display names and body content for Aquent branding and office addresses from unauthorized domains.
Brand impersonation: Aramco
Impersonation of the petroleum and natural gas company Saudi Aramco.
Brand impersonation: AuthentiSign
Detects messages impersonating AuthentiSign through display name, domain, subject, or body content that either originate from non-AuthentiSign or spoofed domains.
Brand impersonation: Automobile assistance associations
Detects messages impersonating automobile associations (AAA, CAA, RAC, etc.) offering vehicle emergency kits or roadside assistance services from untrusted senders.
Brand impersonation: Bank of America
Impersonation of Bank of America, usually for credential theft.
Brand impersonation: Barracuda Networks
Impersonation of Barracuda Networks, an IT security company.
Brand impersonation: Bids & Tenders
Detects links impersonating the Bids & Tenders platform. The rule identifies suspicious links from non-legitimate domains that load Bids & Tenders logo assets, suggesting the sender is spoofing the platform to appear legitimate.