EXPLORE DETECTIONS
Invoice from freemail sender (unsolicited)
An invoice from a freemail sender your organization has never sent an email to before.
Invoicera infrastructure abuse
This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.
Issuu document with suspicious embedded link
Detects when an Issuu document contains suspicious links or text, where the document is set to open in full screen mode. The rule analyzes both embedded links and document content for malicious indicators, particularly focusing on suspicious top-level domains and language patterns.
Job scam (unsolicited sender)
Detects job scam attempts by analyzing the message body text from an unsolicited sender.
Job scam with specific salary pattern
Detects job scam content that includes specific weekly salary mentions (e.g., '$XXX weekly' patterns) in either the current email thread or previous thread conversations, while excluding legitimate income verification services.
KnowBe4 phishing simulation
Identifies phishing simulations sent by KnowBe4 and excludes the message from live analysis.
Link abuse: Self-service creation platform link with suspicious recipient behavior
Detects messages from new freemail senders containing links to self-service creation platforms with all-caps display text, combined with suspicious recipient patterns such as invalid recipients, self-sending, or unusual CC/BCC configurations.
Link to a domain with punycode characters
The body contains a link to a domain with Punycode characters to hide the true URL destination, or contains non-printable ASCII content.
Link to auto-download of a suspicious file type (unsolicited)
A link in the body of the email downloads a suspicious file type (or embedded file) such as an LNK, JS, or VBA. Recursively explodes auto-downloaded files within archives to detect these file types. This rule also catches direct Google Drive download links (drive.google.com/uc?export=download) that automatically download archive files, as these are frequently abused by threat actors to distribute malware. This technique has been used by known threat actors in the wild.
Link to auto-downloaded disk image in encrypted zip
A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot.
Link to auto-downloaded DMG in archive
A link in the body of the message downloads an archive containing a DMG file. The message is not from a common or trusted sender and is unsolicited.
Link to auto-downloaded DMG in encrypted zip
A link in the body of the message downloads an encrypted zip that contains a DMG file. This technique has been observed ITW to deliver Meta Stealer, Atomic Stealer, and other MacOS malware. Notably, in some instances, the attacker poses as a recruiter and initiates back and forth conversation with the recipient.
Link to auto-downloaded file with Adobe branding
A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.
Link to auto-downloaded file with Google Drive branding
A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.
Link to Google Apps Script macro (unsolicited)
Message contains a Google Apps Script macro link. App Scripts can run arbitrary code, including redirecting the user to a malicious web page.
Link to Google Apps Script macro via comment tagging
Message contains a Google Apps Script macro link invoked from a comment on Google Slides|Docs. App Scripts can run arbitrary code, including redirecting the user to a malicious web page.
Link: .onion From Unsolicited Sender
Detects messages containing .onion (Tor network) links from unsolicited senders that either lack proper DMARC authentication or are not from trusted domains.
Link: .su domain link redirection from new sender domains
Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination.
Link: /index.php enclosed in three asterisks
Detects messages containing a specific pattern of triple asterisks surrounding HTTP links that point to PHP index pages with query parameters, indicating potential malicious behavior. This specific pattern has been observed within messages leading to FakeAV/Tech Support scams.
Link: 9WOLF phishkit initial landing URI
Detects links containing the '?ai=xd' query parameter associated with 9wolf phishing service initial landing pages.
Link: Abused Adobe Express
The detection rule matches on message groups which make use of Adobe Express as a landing page. The landing page contains links which are newly registered, use free file or subdomain hosts, url shortners or when visited are phishing pages, lead to a captcha or rediret to a top website.
Link: Adobe share from unsolicited sender
This attack surface reduction rule matches on messages from Adobe which were sent by an email address (as determined by the sender display name) which doesn't appear to have a relationship with the recipient organization.
Link: Adobe share with suspicious indicators
The detection rule matches messages sent from Adobe and contain indicators of malicious use. The indicators include observed call to action phrases, suspicious filenames, all capital filenames, the sender's display name (as determined by NLU) included in the comment section, or Microsoft branding on the shared link.
Link: Apple App Store link to apps impersonating AI adveristing
Detects messages containing links to Apple App Store apps that impersonate popular AI services (OpenAI, ChatGPT, Meta, Gemini) and are categorized as advertising or management tools offered for free.