EXPLORE DETECTIONS
Brand Impersonation: Procore
Detects messages containing Procore branding language that do not originate from legitimate Procore domains. This has been observed in phishing campaigns.
Brand impersonation: Proofpoint secure messaging without legitimate indicators
Detects messages impersonating Proofpoint secure messaging services that contain Proofpoint branding text but lack legitimate Proofpoint secure sharing URIs or authentic attachment indicators, suggesting fraudulent use of the brand.
Brand impersonation: Punchbowl
Detects messages impersonating Punchbowl invitations not originating from legitimate Punchbowl domain.
Brand impersonation: Purdue ePlanroom with suspicious links
Detects messages impersonating Purdue ePlanroom with links that either not from the legitimate reprographix.com domain or contain suspicious credential theft indicators.
Brand impersonation: QuickBooks
Impersonation of the Quickbooks service from Intuit.
Brand impersonation: QuickBooks dispute notification
Detects messages impersonating QuickBooks or Intuit that reference dispute notifications or resolutions, but originate from unauthorized domains that fail DMARC authentication.
Brand impersonation: QuickBooks notification from Intuit themed company name
This detection rule matches on QuickBooks notifications that feature company names impersonating Intuit and QuickBooks.
Brand impersonation: Ripple
Attack impersonating Ripple cryptocurrency, potentially in the form of a giveaway scam.
Brand impersonation: Robert Half
Detects messages impersonating Robert Half, a staffing and recruiting company, by analyzing sender display names, logo detection in message screenshots, and specific company address references in the message body. The rule flags messages from senders not authenticated from legitimate Robert Half domains.
Brand impersonation: Robinhood
Detects messages impersonating Robinhood by analyzing sender display name, domain, body content including specific address references, and social media links, while excluding legitimate Robinhood communications with proper DMARC authentication.
Brand impersonation: Sedgwick Claims
Detects inbound messages that impersonate Sedgwick Claims Management Services, either through a display name containing 'Sedgwick Claim' or through NLU classification identifying Sedgwick as an organization entity alongside high-confidence financial communication topics. Legitimate messages from verified Sedgwick domains (sedgwick.com or sedgwickcms.com) that pass DMARC authentication are excluded.
Brand impersonation: SendGrid
Detects inbound messages that impersonate Twilio/SendGrid through display name or domain manipulation, combined with security or authentication-themed content, while failing authentication checks and originating from untrusted sources.
Brand Impersonation: ShareFile
This detection rule matches on the impersonation of the file sharing site ShareFile. Threat actors have been observed abusing this brand to deliver messages with links to crediential phishing pages.
Brand impersonation: Sharepoint
Body, attached images or pdf contains a Sharepoint logo. The message contains a link and credential theft language.
Brand impersonation: Sharepoint fake file share
This rule detects messages impersonating a Sharepoint file sharing email where no links point to known Microsoft domains.
Brand impersonation: SharePoint PDF attachment with credential theft language
PDF attachment contains SharePoint logo and high-confidence credential theft language detected via OCR analysis. The attachment includes URLs and originates from an unsolicited or low-reputation sender, excluding legitimate SharePoint file sharing notifications.
Brand Impersonation: Shein
Detects suspicious Shein-branded communications using display name impersonation, logo detection, and deceptive content analysis. Includes checks for security/authentication topics, secure messages, notifications, and promotional content like fake surveys or giveaways. Excludes legitimate Shein domains with proper authentication and known trusted senders.
Brand impersonation: Silicon Valley Bank
Detects emails that impersonate Silicon Valley Bank
Brand impersonation: SiriusXM
Impersonation of the broadcasting corporation SiriusXM.
Brand impersonation: Social Security Administration
Detects messages impersonating the Social Security Administration (SSA) through various indicators including display names, subjects, body content, attachments, and HTML titles. The rule identifies SSA references, confusable characters, statement notifications, and credential theft language while excluding legitimate government communications.
Brand impersonation: SoFi
Detects messages impersonating SoFi by analyzing sender display name, domain, body content including specific address references and phone numbers, while excluding legitimate SoFi communications with proper DMARC authentication.
Brand impersonation: Spotify
Impersonation of Spotify.
Brand impersonation: Square
Impersonation of Square, typically containing security-related language, secure message notifications, or credential theft indicators from unauthorized senders.
Brand impersonation: Squarespace
Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks.