EXPLORE DETECTIONS
Attachment: Microsoft impersonation via PDF with link and suspicious language
Attached PDF contains a Microsoft-affilated logo, suspicious language or keywords, and a link. Known malware delivery method.
Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links
Detects inbound messages containing EML attachments with embedded links targeting Microsoft OAuth authentication flows. The rule identifies suspicious Microsoft login URLs with specific query parameters indicating credential harvesting attempts, including offline access permissions, read/write scopes, and reprocessing endpoints. Links are detected within EML body content, embedded PDF/HTML attachments, and ICS calendar files.
Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment
Detects macro-enabled Office documents (docx and similar extensions) that contain images with text mimicking Microsoft SharePoint file-sharing notifications. The embedded images reference SharePoint collaboration language such as invitations to edit or references to Microsoft 365 access controls, designed to deceive recipients into trusting the attachment.
Attachment: Mobileconfig profile with mismatched embedded email
Detects inbound messages with a mobileconfig attachment containing an embedded email address whose domain differs from the sender's domain and does not match any known sender or recipient address. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK
Detects embedded Shell.Explorer.1 COM objects containing LNK files within various file types.
Attachment: MS OOXML file created by Administrator with zero edit time
Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.
Attachment: MSI installer file
Recursively scans files and archives to detect MSI installer files. Coercing a target user to run an MSI can be used as part of an 'IT Support' or 'software update' social engineering attack. Execution of the delivered MSI could enable the attacker to execute malicious code on the target user's host.
Attachment: Office document loads remote document template
Recursively scans archives and Office documents to detect remote document template injection.
Attachment: Office document with VSTO add-in
Recursively scans files and archives to detect Office documents with VSTO Add-ins.
Attachment: Office file contains OLE relationship to credential phishing page
Office file OLE relationship link is a credential page, or contains credential phishing language.
Attachment: Office file with credential phishing URLs
Detects Office documents containing embedded URLs that redirect to credential phishing pages. The rule filters out standard XML namespace and schema URLs commonly found in legitimate Office documents, then analyzes remaining URLs for malicious content using machine learning link analysis.
Attachment: Office file with document sharing and browser instruction lures
Detects macro-enabled attachments containing document sharing language (sent, shared, forwarded) combined with browser interaction instructions (copy, right-click) or common email disclaimers. These tactics are often used to trick users into enabling macros or following malicious instructions.
Attachment: Office file with suspicious function calls or downloaded file path
Attached Office file contains suspicious function calls or known malicious file path pattern.
Attachment: OLE external relationship containing file scheme link to executable filetype
This rule identifies attachments containing file scheme links pointing to executable file types, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software.
Attachment: OLE external relationship containing file scheme link to IP address
This rule identifies attachments containing file scheme links pointing to IP Addresses, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software. The rule negates firing on IP addresses governed by RFC1918 or privately allocated space.
Attachment: Oversized guest-list calendar invite with purchase order lure
Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request.
Attachment: Oversized guest-list calendar invite with voicemail lure
Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches voicemail call or missed call notifications, a common pretext used to lure recipients.
Attachment: Password-protected PDF with fake document indicators
Detects PDF attachments that are password protected and matching YARA signatures looking for specific content observed in previous activity.
Attachment: PDF Adobe lure
Detects inbound messages containing PDF attachments that match a YARA signature identifying Adobe-themed lure content.
Attachment: PDF Attachment with links to workers.dev
Detects inbound messages containing PDF attachments with fewer than 5 pages that, when analyzed, contain URLs pointing to workers.dev subdomains. This pattern indicates potential abuse of Cloudflare Workers infrastructure to host malicious content delivered via PDF documents.
Attachment: PDF bid/proposal lure with credential theft indicators
Detects single-page PDF attachments containing bid, proposal, RFP, RFQ, or quotation-related lures combined with high-confidence credential theft language or suspicious domains. The rule examines various locations including PDF URLs, OCR content, file names, subject lines, and message body for these indicators.
Attachment: PDF contains W9 or invoice YARA signatures
PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.
Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link
Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection.
Attachment: PDF document portal credential theft lure
Detects inbound messages with an empty body that carry a PDF attachment referencing document portal or review invitation language alongside the recipient's own email address embedded in the file. The attachment content is further validated by an NLU classifier with high confidence for credential theft intent. Messages from highly trusted sender domains that pass DMARC authentication are excluded.