EXPLORE DETECTIONS
Brand impersonation: Microsoft fake sign-in alert
Detects messages impersonating Microsoft that mimic sign-in security alerts and attempt to solicit a response.
Brand impersonation: Microsoft logo image linking to free file host
Detects inline images that display a Microsoft logo and contain text, used as clickable links within the message body. The link behind the image redirects to a self-service site creation platform or free file hosting domain rather than a legitimate Microsoft or tenant domain, a common technique for disguising credential phishing or malware delivery links as trusted Microsoft branded content.
Brand impersonation: Microsoft logo in HTML with fake quarantine release notification
A message containing a Microsoft logo generated using HTML tables and references to the Microsoft Exchange quarantine, but did not come from Microsoft.
Brand impersonation: Microsoft logo or suspicious language with open redirect
Message contains a Microsoft logo or suspicious terms and use of an open redirect. This has been exploited in the wild to impersonate Microsoft.
Brand impersonation: Microsoft Planner with suspicious link
Impersonation of Microsoft Planner, a component of the Microsoft 365 software suite.
Brand impersonation: Microsoft quarantine release notification in body
Message containing suspicious quarantine release language in the body, and a Microsoft logo attachment but did not come from Microsoft.
Brand impersonation: Microsoft quarantine release notification in image attachment
Message with an image attachment containing credential theft language and references to the Microsoft Exchange quarantine, but did not come from Microsoft.
Brand impersonation: Microsoft Teams
Impersonation of a Microsoft Teams message.
Brand impersonation: Microsoft Teams invitation
Detects messages impersonating a Microsoft Teams invites by matching known invite text patterns while containing join links that do not resolve to Microsoft domains. Additional verification includes checking for absent phone dial-in options and missing standard Teams help text or HTML meeting components.
Brand impersonation: Microsoft with embedded logo and credential theft language
This rule detects messages impersonating Microsoft via a logo and contains credential theft language. From a new and unsolicited sender.
Brand impersonation: Microsoft with low reputation links
Detects low reputation links with Microsoft specific indicators in the body.
Brand impersonation: Morgan Stanley
Detects messages impersonating Morgan Stanley that contain indicators of credential theft or callback scams, including references to secure email systems, client service centers, financial advisors, and registration processes. The rule identifies spoofed communications by checking for Morgan Stanley branding elements while excluding legitimate domains.
Brand impersonation: MyChart
Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded.
Brand impersonation: Navan
Impersonation of the expense management provider Navan.
Brand impersonation: Netflix
Impersonation of Netflix.
Brand impersonation: Norton
Scans files to detect Norton (Lifelock|360|Security) impersonation.
Brand impersonation: Office 365 mail service
Detects messages from domains containing both 'o365' and 'mail' in the second-level domain, commonly used to impersonate legitimate Microsoft Office 365 mail services.
Brand impersonation: Okta
Impersonation of Okta, an identity and access management company.
Brand Impersonation: OpenAI with ChatGPT Ads lure
Detects messages impersonating OpenAI or ChatGPT, that contain specific references to ChatGPT Ads. Observed harvesting advertisting account credentials.
Brand impersonation: OpenAI with payment issues
Detects messages impersonating OpenAI or ChatGPT with payment-related content such as subscription cancellation, payment failures, or billing updates from non-OpenAI domains.
Brand impersonation: Outlook
Impersonation of Outlook.com. Senders with "outlook.com" in the subdomain have been observed sending fake account notifications.
Brand impersonation: Paperless Post
Detects messages containing multiple images hosted on ppassets.com (Paperless Post's asset domain) but with fewer than 3 legitimate Paperless Post links, while excluding authentic forwards/replies and messages from verified Paperless Post domains with valid DMARC authentication.
Brand Impersonation: PayPal
Impersonation of PayPal.
Brand impersonation: PNC
Impersonation of PNC Financial Services