EXPLORE DETECTIONS
Attachment: EML with Sharepoint link likely unrelated to sender
Detects EML attachments containing SharePoint links where the subdomain differs significantly from the sender's domain, potentially indicating SharePoint impersonation or domain spoofing tactics.
Attachment: EML with suspicious indicators
Attached EML contains suspicious indicators, such as a missing sender email or short HTML body.
Attachment: Emotet heavily padded doc in zip file
Detects a potential Emotet delivery method using padded .doc files that compress into small zip files. Contents may include Red Dawn templates exceeding 500MB.
Attachment: Employment contract update with suspicious file naming
Detects messages containing two attachments where one is a PowerPoint file with suspicious character substitution in the filename ('Empl0yment' using zero instead of 'o') and body text claiming an employment contract has been updated.
Attachment: Encrypted Microsoft Office file (unsolicited)
Encrypted OLE2 (eg Microsoft Office) attachment from an unsolicited sender. Attachment encryption is a common technique used to bypass malware scanning products. Use if receiving encrypted attachments is not normal behavior in your environment.
Attachment: Encrypted PDF With Credential Harvesting Indicators
Detects encrypted PDF attachments containing patterns and indicators commonly associated with credential harvesting operations, identified through YARA signature analysis.
Attachment: Encrypted PDF with credential phishing link
Detects inbound emails containing an encrypted PDF attachment whose cracked password is shared within the email body, and that also includes a small number of embedded URLs flagged for credential theft risk based on newly registered domains or natural language understanding analysis of the link's rendered content.
Attachment: Encrypted PDF with credential theft body
Attached PDF is encrypted, and email body contains credential theft language. Seen in-the-wild impersonating e-fax services.
Attachment: Encrypted PDF with credential theft language in EML
Attached PDF is encrypted, and email body contains credential theft language, wrapped in an attached .eml file. Seen in-the-wild impersonating e-fax services.
Attachment: Encrypted ZIP containing VHDX file
Detects ZIP attachments that are encrypted and contain VHDX files, which may be used to bypass security controls or deliver malicious payloads.
Attachment: Encrypted zip file with payment-related lure
Detects messages containing zip file attachments with payment-themed content that reference encrypted files, passwords, and payment details. The rule looks for specific patterns indicating the attachment is encrypted and contains payment-related information, commonly used to evade security scanning by requiring manual extraction.
Attachment: Excel file with document sharing lure created by Go Excelize
Detects Excel macro files created with the Go Excelize library containing document sharing language such as 'sent document', 'shared file', or 'REVIEW DOCUMENT'. These files are often used as lures to trick users into enabling macros or downloading malicious content.
Attachment: Excel file with hyperlinks to suspicious domains
Flags inbound emails that show signs of business email compromise or credential theft intent—either through NLU classification or language like 'your review'/'please review'—and include an Excel attachment. The attachment is exploded and its exiftool metadata inspected for embedded hyperlinks, which are then parsed and checked against lists of free subdomain hosts, free file hosts, suspicious TLDs, and URL shorteners.
Attachment: Excel file with suspicious template identifier
Detects Excel attachments containing a specific template identifier (TM16390866) in the EXIF metadata, which may indicate malicious or suspicious document templates being used to distribute harmful content.
Attachment: Excel Web Query File (IQY)
Recursively scans files and archives to detect IQY files. Coercing a target user into providing credentials to an attacker-controlled web server, or for SMB relaying.
Attachment: Fake attachment image lure
Message (or attached message) contains an image impersonating an Outlook attachment button.
Attachment: Fake email body embedded in inline image
Catches messages with almost no visible body text and a single link, where an inline image doubles as both the message body and the link destination. The image is OCR'd and the extracted text is run through an NLU classifier to confirm credential-theft intent, matching lures such as fake voicemail transcripts, document-sharing notifications, and workflow addendum requests. Highly trusted sender domains that pass DMARC are excluded to reduce false positives.
Attachment: Fake lawyer & sports agent identities
Detects messages containing attachments or content that reference known fake identities used in FC Barcelona scams, including fake lawyer Michael Gerardus Hermanus Demon and sports agents with the surname Giuffrida. The rule examines EXIF metadata, OCR text from attachments, and message body content for these specific identity markers.
Attachment: Fake mobileconfig security update profile
Detects .mobileconfig attachments that present themselves as an Apple 'Security Update' configuration profile but omit the PayloadContent section required for a legitimate profile. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.
Attachment: Fake PDF Invoices Yara
These yara signatures match fake invoice PDFs with specific artifiacts including images and link locations.
Attachment: Fake research internship offer
Detects inbound, non-reply/forward emails referencing research, internship, or fellowship opportunities with weekly stipend language, accompanied by a PDF attachment whose OCR-extracted text confirms a research/internship role, cites a weekly dollar stipend, and directs recipients to respond via personal free-mail addresses, text message, or an alternate email—hallmarks of fraudulent job/internship scams designed to harvest personal information or payment.
Attachment: Fake scan-to-email
Message and attachment resemble an email from a scan-to-email service or device with credential theft language.
Attachment: Fake secure message and suspicious indicators
Body contains language resembling credential theft, and an attached "secure message" from an untrusted sender.
Attachment: Fake Slack installer
HTML attachment contains a Slack logo, request language, and a link to an executable. Observed in the wild.