EXPLORE DETECTIONS
Attachment: Fake voicemail via PDF
Identifies inbound messages containing a single-page PDF attachment related to voicemail or missed call notifications that includes either a URL or QR code.
Attachment: Fake Zoom installer
HTML attachment contains a Zoom logo, request language, and a link to an executable. Observed in the wild.
Attachment: Fictitious invoice using LinkedIn's address
Detects PDF attachments created with wkhtmltopdf or Qt that contain LinkedIn's headquarters address (1000 W Maude Ave) in financial communications context, but do not mention LinkedIn itself.
Attachment: File execution via Javascript
Javascript contains identifiers or strings that may attempt to execute files.
Attachment: Filename containing Unicode braille pattern blank character
Recursively identifies attachments that attempt to conceal their true file extension by using Braille Pattern Blank characters
Attachment: Filename containing Unicode right-to-left override character
Recursively identifies attachments that attempt to conceal their true file extension by using right-to-left override characters
Attachment: Finance themed PDF with observed phishing template
Detects PDF attachments containing a specific rectangular coordinate pattern at position [249.75 560 407.25 599.75], which may indicate a templated or malicious document structure.
Attachment: Google share.google URL shortener in google.<tld>/share.google path form
Detects inbound messages whose attachments contain links in the form google.<tld>/share.google?q=<code>, which inherits google.<tld> domain reputation to mask an attacker-controlled destination. This google.<tld>/share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter. ICS calendar attachments are covered by a separate rule.
Attachment: GZ archive with credential theft content
Detects inbound messages containing a .gz attachment that, when exploded, contains an email or HTML file. The rule then inspects the inner content for credential theft intent—either by parsing a well-formed embedded EML and running NLU classification on the message body, or, if the EML is malformed, by extracting HTML content, pulling href links, and running link analysis plus NLU classification on the resulting page text to identify high-confidence credential theft indicators.
Attachment: Gzip-archived with nested HTML file containing image and button link
Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload.
Attachment: Hex-encoded recipient email in URL fragment
Detects non-ICS attachments (PDFs, Office docs, HTML, etc.) that embed a URL whose fragment contains the recipient's email address encoded in hexadecimal. This technique is used to personalize or track clicks on malicious links delivered via file attachments rather than inline in the message body. Observed samples largely spoof financial or invoicing correspondence—such as invoice notices, AR aging reports, and cashflow or change-order updates—to lure recipients into opening the attachment and following the embedded link, often leading to credential phishing.
Attachment: HTML attachment with Javascript location
Recursively scans files and archives to detect HTML smuggling techniques.
Attachment: HTML attachment with login portal indicators
Recursively scans files and archives to detect indicators of login portals implemented in HTML files. This is a known credential theft technique used by threat actors.
Attachment: HTML file contains exclusively Javascript
Attached HTML file does not contain any HTML other than a <script> block.
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
Detects messages with HTML attachments containing multiple 'const' declarations while excluding legitimate Gmail messages. This is evidence of potential code injection or obfuscation techniques.
Attachment: HTML file with excessive padding and suspicious patterns
Attached HTML file contains excessive line breaks and suspicious Javascript patterns.
Attachment: HTML file with reference to recipient and suspicious patterns
Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
Attachment: HTML smuggling - QR Code with suspicious links
This rule detects messages with HTML attachments containing QR codes
Attachment: HTML smuggling 'body onload' linking to suspicious destination
Potential HTML Smuggling. This rule inspects HTML attachments that contain a single link and leveraging an HTML body onload event. The linked domain must be in the URLhaus trusted repoters list, or have a suspicious TLD.
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text
Potential HTML Smuggling. This rule inspects HTML attachments that contain "body unload", high entropy, and suspicious text.
Attachment: HTML smuggling Microsoft sign in
Scans HTML files to detect HTML smuggling techniques impersonating a Microsoft login page.
Attachment: HTML smuggling with atob and high entropy
Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.
Attachment: HTML smuggling with atob and high entropy via calendar invite
Scans calendar invites (.ics files) to detect HTML smuggling techniques.
Attachment: HTML smuggling with auto-downloaded file
HTML attachments containing files that are automatically downloaded with Javascript.