EXPLORE DETECTIONS
Brand impersonation: DocuSign with embedded QR code
This rule detects unsolicited messages with short bodies containing a DocuSign logo, QR code language and an embedded QR code.
Brand impersonation: DoorDash
Impersonation of the online food ordering and food delivery platform, DoorDash
Brand impersonation: Dotloop
Impersonation of Dotloop, a real estate transaction management platform.
Brand impersonation: Dropbox
Impersonation of Dropbox, a file sharing service.
Brand impersonation: Enbridge
Impersonation of the Canadian energy company Enbridge.
Brand impersonation: Evite
Detects messages impersonating Evite invitations by looking for invitation language while not originating from legitimate Evite domains.
Brand impersonation: Exodus
Attack impersonating Exodus Wallet.
Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains
Detects HTML table elements that mimick DocuSign templates linking to non-DocuSign destinations. The rule negates high trusted sender domains and legitimate replies.
Brand impersonation: Fake Fax
Detects messages containing fax-related language and notification elements from senders outside of known legitimate fax service providers.
Brand impersonation: Fake procurement/RFQ PDF from energy and industrial companies
Detects inbound PDF attachments impersonating well-known energy and industrial companies (Neste, TotalEnergies, Vattenfall, MOL Group, Unilever, Shell, Waldinger, Novo Nordisk) using fabricated procurement orders, requests for quotation, or supply chain solicitation documents. OCR is used to identify specific branding, addresses, and keywords embedded in these fraudulent PDF templates.
Brand impersonation: Fastway
Impersonation of Fastway Couriers, a delivery services company in Ireland and South Africa.
Brand impersonation: FedEx
Impersonation of the shipping provider FedEx.
Brand impersonation: Figma with malicious document access overlay
"Detects malicious Figma design shares containing brand impersonation or credential phishing content. The rule identifies legitimate Figma share notifications where the embedded thumbnail preview contains "access document" text when OCR'd. Attackers create phishing designs (impersonating Microsoft, DocuSign, or other brands) within Figma, then share them via Figma's legitimate infrastructure to bypass sender reputation checks. The malicious content is rendered in the Figma-hosted thumbnail image itself."
Brand impersonation: File sharing notification with template artifacts
Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.
Brand impersonation: FINRA
Impersonation of the Financial Industry Regulatory Authority (FINRA)
Brand Impersonation: Gemini Trust Company
Detects messages impersonating Gemini Trust Company through analysis of footer content, social media links, and address verification, excluding legitimate communications from authenticated Gemini domains.
Brand impersonation: Github
Impersonation of Github.
Brand impersonation: Github (sawfish campaign)
Impersonation of Github, potentially as part of the sawfish campaign, seeking to harvest Github credentials.
Brand impersonation: GitHub with callback scam indicators
Detects messages using GitHub's noreply address that contain callback scam language, brand impersonation tactics, or fraudulent purchase/payment content with phone numbers for victim contact.
Brand impersonation: GoDaddy
Detects messages where the sender is impersonating GoDaddy through display name manipulation or lookalike domains, while not being legitimately authenticated from GoDaddy's infrastructure.
Brand Impersonation: Google (QR Code)
Detects messages using Google based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.
Brand impersonation: Google Authenticator
Detects inbound messages where the sender name claims to be Google Authenticator, but the sending domain is not associated with Google or Okta and fails DMARC authentication, indicating a likely impersonation of the two-factor authentication service.
Brand impersonation: Google Careers
Detects messages impersonating Google Careers or job opportunities in multiple languages that contain links to domains other than Google's legitimate domains, from senders not authenticated as Google.
Brand impersonation: Google Drive fake file share
This rule detects messages impersonating a Google Drive file sharing email where no links point to known Google domains.