EXPLORE DETECTIONS
Brand impersonation: Google fake sign-in warning
Detects messages with image attachments containing fake Google sign-in warnings with no links leading to Google sites.
Brand impersonation: Google Meet with malicious link
Detects messages with 'Join with Google Meet' display text that redirects to domains other than meet.google.com.
Brand impersonation: Google using Microsoft Forms
Abuses Microsoft Forms to impersonate Google.
Brand impersonation: Google Workspace alert notification
Detects messages impersonating Google Workspace alert notifications that use Google branding elements, workspace-specific terminology, and admin console references, but originate from non-Google domains and contain suspicious links.
Brand impersonation: Government / Tax Authority document lure
Detects messages impersonating government and tax authorities (such as the IRS, SSA, Department of Treasury, and similar agencies) that contain suspicious document-related links. The rule identifies either download calls-to-action pointing to low-reputation or free subdomain hosts, or phishing-kit URLs that embed the impersonated organization's name in the path. Credential theft intent is confirmed via NLP analysis, and trusted sender domains are only flagged when DMARC authentication fails.
Brand impersonation: Greenvelope
Detects messages impersonating Greenvelope invitations not originating from legitimate Greenvelope domain.
Brand impersonation: Greetings Island
Detects messages that impersonate the e-vite service Greetings Island by referencing its branding, copyright footer, or logo.
Brand impersonation: Gusto
Impersonation of Gusto, a cloud-based payroll management company.
Brand impersonation: Hulu
Impersonation of Hulu.
Brand impersonation: Interac
Impersonation of the Canadian interbanking network Interac. Seen in the wild impersonating carbon tax rebates and tax return refunds.
Brand impersonation: Internal Revenue Service
Detects messages from senders posing as the Internal Revenue Service by checking display name similarity and content indicators from body text and screenshots. Excludes legitimate IRS domains and authenticated senders.
Brand impersonation: KnowBe4
Impersonation of KnowBe4.
Brand impersonation: Kroger
Detects inbound messages that impersonate Kroger through a spoofed display name or local part while referencing loyalty program terms such as boost membership, renewal, verification, or points balance in the body or a rendered screenshot. Legitimate messages from verified Kroger domains or high trust senders that pass DMARC, as well as newsletters/digests, are excluded to reduce false positives.
Brand impersonation: LastPass
Detects messages impersonating the password manager LastPass that contain suspicious language about maintenance, vault exports, or master passwords.
Brand impersonation: Ledger
Attack impersonating hardware cryptocurrency wallet ledger.com's brand.
Brand impersonation: LinkedIn
Impersonation of LinkedIn.
Brand impersonation: Mailchimp
Detects messages from senders impersonating Mailchimp through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns.
Brand impersonation: Mailgun
Impersonation of the Mailgun Email delivery platform.
Brand impersonation: Marriott with gift language
Detects messages impersonating Marriott brand that contain gift-related language such as 'appreciation gift', 'thank you gift', or 'something special' from senders not associated with legitimate Marriott domains.
Brand impersonation: McAfee
Detects messages impersonating McAfee through display name, subject line, body content, or NLU entity detection when the sender is not from verified McAfee domains or other high-trust domains with valid DMARC authentication.
Brand impersonation: Meta and subsidiaries
Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.
Brand impersonation: MetaMask
Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication.
Brand impersonation: Microsoft
Impersonation of the Microsoft brand.
Brand impersonation: Microsoft (QR code)
Detects messages using Microsoft image based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.