EXPLORE DETECTIONS
Attachment: ICS voicemail lure with suspicious link
Detects inbound emails containing an ICS calendar attachment whose event description mimics a voicemail notification (e.g., 'new voicemail', 'listen to your voicemail') and includes a link pointing to a free file hosting service, self-service creation platform, URL shortener, suspicious TLD, or a domain registered within the last 90 days. Excludes messages from high-trust sender domains that pass DMARC authentication.
Attachment: ICS with embedded document
ICS invite contains an embedded document.
Attachment: ICS with embedded Javascript in SVG file
Detects incoming messages containing ICS attachments with embedded SVG files that contain malicious JavaScript code, including base64-encoded content and potentially harmful event handlers. The rule specifically watches for onload events, location redirects, error handlers, and iframe elements with base64 data URIs.
Attachment: ICS with employee policy review lure
Detects ICS calendar attachments containing references to 'policy review' and 'secure access' terminology, which may be used in social engineering attacks to prompt users to take action under the guise of compliance or security requirements.
Attachment: ICS with Suspicious Office 365 app authorization (OAuth) link
Detects inbound messages with ICS calendar invites containing a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account.
Attachment: Identity Confirmation With Document Unlock Code
Detects short inbound messages referencing an attached document that requires the recipient to confirm their identity and enter a code to unlock it, sent within an active thread context.
Attachment: Image-only docx/pptx callback phishing
Detects inbound emails with docx or pptx attachments that contain no text but exactly one embedded image, a common tactic to evade text-based scanning by presenting content as a picture. The rule then inspects any extracted text from the image for a combination of callback phishing lures—such as references to subscriptions, invoices, refunds, or antivirus renewals alongside phone numbers or dollar amounts—paired with impersonation of well-known brands like PayPal, McAfee, Norton, or Best Buy, indicating a fraudulent phone-based scam attempt.
Attachment: Invoice and W-9 PDFs with suspicious creators
Detects messages containing two PDF attachments where one has invoice-related naming patterns and another contains W-9 tax form indicators, commonly used in business email compromise attacks targeting financial processes.
Attachment: JavaScript file with suspicious base64-encoded executable
JavaScript attachment or compressed JavaScript file containing a base64 encoded executable.
Attachment: JPEG with gd-jpeg creator and suspicious file name
Detects inbound messages containing a single JPEG attachment with specific filename patterns and EXIF metadata indicating creation by gd-jpeg v1.0. This has been observed being used to produce company logos used within phishing messages.
Attachment: Legal themed message or PDF with suspicious indicators
Detects messages with short body content or emoji containing PDF attachments from suspicious creators that include legal and compliance language with embedded malicious links, URL shorteners, or newly registered domains.
Attachment: Link file with UNC path
Attached link file contains a UNC path. This can be used to relay NTLM password hashes; Windows will attempt to authenticate against the path even without the file being opened.
Attachment: Link to Doubleclick.net open redirect
Doubleclick.net link in a document leveraging an open redirect.
Attachment: LNK file
Recursively scans files and archives to detect LNK connection files. LNK files can be weaponised to execute arbitrary commands including unpacking and running executable content embedded within the file itself.
Attachment: LNK with embedded content
Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.
Attachment: Macro files containing MHT content
Detects macro-enabled files that contain embedded MHT (MIME HTML) content, which is commonly used to hide malicious code through file format manipulation.
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation
Macro references the ShellBrowserWindow COM object which can be used to spawn new processes from Explorer.exe rather than as a child process of the Office application. This can be useful for a threat actor attempting to evade security controls.
Attachment: Malformed mobileconfig file
Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes.
Attachment: Malformed OLE file
Attached OLE file (typically a Microsoft Office document) is malformed, possibly to evade traditional scanners and filters.
Attachment: Malicious mobileconfig profile
Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.
Attachment: Malicious OneNote commands
Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.
Attachment: Malicious zip file matching zipline campaign
Detects inbound ZIP attachments containing content that matches observed artifacts from a ZipLine campaign reported on by Telekom Security.
Attachment: Meetergo booking link
Detects inbound messages containing an attachment that embeds a link to a Meetergo scheduling page.
Attachment: Microsoft 365 credential phishing
Looks for messages with an image attachment that contains words related to Microsoft, Office365, and passwords.