EXPLORE DETECTIONS
Attachment: HTML with hidden body
This rule identifies HTML attachments which begin directly with a hidden body element. This has been observed in phishing campaigns to hide the content of an otherwise benign HTML attachment that then has remote content injected into the body.
Attachment: HTML with JavaScript functions for HTTP requests
This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.
Attachment: HTML with obfuscation and recipient's email in JavaScript strings
Attached HTML file contains JavaScript code with suspicious identifiers like 'atob' or 'decrypt', as well as the recipient's email address embedded within the JavaScript
Attachment: ICS calendar with embedded file from internal sender with SPF failure
Detects calendar invitations (ICS files) from internal domains that fail SPF authentication and contain embedded attachments, with single attendee and organizer both from organizational domains.
Attachment: ICS file with AWS Lambda URL
Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.
Attachment: ICS file with excessive custom properties
ICS calendar attachment contains an unusually high number of custom X- properties, which may indicate attempts to hide malicious content or exploit calendar parsing vulnerabilities.
Attachment: ICS file with meeting prefix
Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.
Attachment: ICS file with non-Gregorian calendar scale
Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.
Attachment: ICS with embedded document
ICS invite contains an embedded document.
Attachment: ICS with embedded Javascript in SVG file
Detects incoming messages containing ICS attachments with embedded SVG files that contain malicious JavaScript code, including base64-encoded content and potentially harmful event handlers. The rule specifically watches for onload events, location redirects, error handlers, and iframe elements with base64 data URIs.
Attachment: ICS with employee policy review lure
Detects ICS calendar attachments containing references to 'policy review' and 'secure access' terminology, which may be used in social engineering attacks to prompt users to take action under the guise of compliance or security requirements.
Attachment: Invoice and W-9 PDFs with suspicious creators
Detects messages containing two PDF attachments where one has invoice-related naming patterns and another contains W-9 tax form indicators, with at least one PDF generated by Chrome or wkhtmltopdf tools, commonly used in business email compromise attacks targeting financial processes.
Attachment: JavaScript file with suspicious base64-encoded executable
JavaScript attachment or compressed JavaScript file containing a base64 encoded executable.
Attachment: Legal themed message or PDF with suspicious indicators
Detects messages with short body content or emoji containing PDF attachments from suspicious creators that include legal and compliance language with embedded malicious links, URL shorteners, or newly registered domains.
Attachment: Link file with UNC path
Attached link file contains a UNC path. This can be used to relay NTLM password hashes; Windows will attempt to authenticate against the path even without the file being opened.
Attachment: Link to Doubleclick.net open redirect
Doubleclick.net link in a document leveraging an open redirect from a new or outlier sender.
Attachment: LNK file
Recursively scans files and archives to detect LNK connection files. LNK files can be weaponised to execute arbitrary commands including unpacking and running executable content embedded within the file itself.
Attachment: LNK with embedded content
Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.
Attachment: Macro files containing MHT content
Detects macro-enabled files that contain embedded MHT (MIME HTML) content, which is commonly used to hide malicious code through file format manipulation.
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation
Macro references the ShellBrowserWindow COM object which can be used to spawn new processes from Explorer.exe rather than as a child process of the Office application. This can be useful for a threat actor attempting to evade security controls.
Attachment: Malformed OLE file
Attached OLE file (typically a Microsoft Office document) is malformed, possibly to evade traditional scanners and filters.
Attachment: Malicious OneNote commands
Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.
Attachment: Microsoft 365 credential phishing
Looks for messages with an image attachment that contains words related to Microsoft, Office365, and passwords.
Attachment: Microsoft impersonation via PDF with link and suspicious language
Attached PDF contains a Microsoft-affilated logo, suspicious language or keywords, and a link. Known malware delivery method.