EXPLORE DETECTIONS
Link: Suspicious file retrieval with recipient targeting
Detects inbound messages containing links with '/getfile/filefor' URL paths that include the recipient's email address, indicating potential targeted file delivery or credential harvesting.
Link: Suspicious go.php redirect with document lure
Detects links containing a PHP redirect endpoint with authentication parameters, commonly used in malicious redirects and unauthorized access attempts.
Link: Suspicious HTML structure with subject mirrored in body and single link
Detects messages where the subject is mirrored in a styled HTML table element, while containing exactly one link. This structural pattern is indicative of templated lures designed to appear legitimate.
Link: Suspicious Loom HTML file path
Detects inbound messages containing links to Loom HTML files, which may be used to deliver malicious content or bypass security controls through the legitimate Loom platform.
Link: Suspicious recipient with timeout redirect
Detects inbound messages sent to self, invalid recipients, or undisclosed recipients containing links that, upon analysis, include a JavaScript setTimeout redirect. This technique delays redirection and appends URL fragments to evade static link inspection.
Link: Suspicious SharePoint document name
The detection rule is intended to match on emails sent from SharePoint indicating a shared file to the recipient that contain suspicious content within the document name. The Link display text is leveraged to identify the name of the shared file.
Link: Suspicious Sharepoint folder share
Detection Rule matches on messages which contain a link to a sharepoint shared folder containing a single file which is either a .url file, the filename is all caps, or includes call to action wording. These messages must not be sent from sharepoint and are either not solicited or from a new or outlier sender.
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Detects inbound messages containing a single unique root domain across all links, where at least one link follows a suspicious path pattern. Additionally, the message body contains HTML elements consistent with financial lure tactics, such as 'cash offer', 'confirm info', or 'view rates' styled with specific background colors indicative of a structured deceptive template.
Link: Suspicious URL path with binary character sequence
Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).
Link: Suspicious URL with recipient targeting and special characters
Detects messages containing links with special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns.
Link: Suspicious wp-admin path from mismatched sender domain
Detects inbound messages containing links to a WordPress /wp-admin/ path where the link domain does not match the sender's domain. Matches two patterns: a single directory under /wp-admin/ with no file extension, or a .php payload nested at least one subdirectory below /wp-admin/ (e.g. /wp-admin/foo/bar.php). Both are indicative of compromised WordPress sites being repurposed to host phishing pages; legitimate WP notification paths like/wp-admin/admin.php are excluded by the subdirectory requirement.
Link: SVG with embedded recipient data
Detects SVG links that contain the recipient's email address either in plain text or base64 encoded format within the URL, indicating potential tracking or targeting mechanisms.
Link: Tax document lure Portuguese/Spanish with suspicious domains
Detects messages in Portuguese/Spanish containing tax document phrases that link to suspicious domains including URL shorteners, free file hosts, or newly registered domains.
Link: Telegraph-hosted content
Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability.
Link: Tycoon2FA phishing kit (non-exhaustive)
Detects links utilizing the Tycoon2FA phishing kit, identified by specific DOM structure patterns and CDN characteristics, combined with suspicious domain indicators such as free subdomain hosts or suspicious TLDs. As the Tycoon2FA kit is evolving, this rule will not detect all variants of Tycoon2FA phishing, and is designed to compliment existing and future detections.
Link: Uncommon SharePoint document type with sender's display name
Detects SharePoint file shares containing personal OneNote or PDF files where the file name matches the sender's display name.
Link: Unformatted template with literal placeholder in mailto link
Detects inbound messages containing mailto links whose href URL still contains an unresolved template placeholder, indicating the sender used a templating system but failed to substitute real values before sending. Two patterns are flagged: an '@{domain}' placeholder, treated as a strong standalone signal; and a '{RECIPIENT_EMAIL}' or '{SENDER_EMAIL}' placeholder (case-insensitive, allowing an underscore or space before 'EMAIL'), which fires only when the NLU classifier detects high-confidence credential-theft (cred_theft) or business-email-compromise (bec) intent in the current thread, suppressing benign templated mail.
Link: Unicode character obfuscation in display name with base64-encoded URL fragment
Detects inbound messages where the sender's display name contains Unicode format characters (such as word joiners or invisible separators) interspersed between letters to evade text-based detection. These messages carry links whose URL fragments are unusually long (over 100 characters) and match a base64url-encoded pattern, a technique used to smuggle encoded payloads past URL scanners.
Link: Unsolicited email contains link leading to Tycoon URL structure
Detects unsolicited messages containing links leading to specific tycoon URL patterns that include encoded email addresses or base64-encoded content in the path structure.
Link: Unsolicited email contains link to page containing Tycoon URI structure
Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.
Link: URL fragment with hexadecimal pattern obfuscation
Detects links containing URL fragments with repeating hexadecimal patterns, commonly used to obfuscate malicious destinations or bypass security filters.
Link: URL fragmented by hidden spans
Detects messages containing HTML links that are broken up with inline <span> elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link.
Link: URL path containing /moni/index
Detects inbound messages containing links to '/moni/index.' paths, either directly in the URL path or within query parameters. This pattern has been observed in the wild leading to credential phishing
Link: URL redirecting to blob URL
Detects messages containing links that redirect to blob URLs, indicating potential malware delivery or credential harvesting.