Browse Rules

Credential phishing link (unknown sender)

Message contains a link to a credential phishing page from an unknown sender.

Link: Credential phishing link with undisclosed recipients

This rule detects messages with "Undisclosed Recipients" that contain a link to a credential phishing page.

Attachment: Office file contains OLE relationship to credential phishing page

Office file OLE relationship link is a credential page, or contains credential phishing language.

Service Abuse: Box file sharing with credential phishing intent

Detects abuse of Box's legitimate infrastructure for credential phishing attacks.

Proofpoint Phishing Email Detected

This rule alerts when Proofpoint detects phishing attempts in email. It triggers when emails are quarantined with the phish rule, have a high phish score (90+), or contain active phishing threats in the threats map.

Credential phishing: 'Secure message' and engaging language

Body contains language resembling credential theft, and a "secure message" from an untrusted sender.

Credential phishing: Fake storage alerts (unsolicited)

This rule targets credential phishing attempts disguised as storage space alerts, activating for inbound emails with specific storage-related keywords and evaluating sender trustworthiness and history.

Attachment: PDF with blurry lure image

Detects PDF attachments containing a blurry image used in credential phishing lures.

Open redirect (go2.aspx) leading to Microsoft credential phishing

This rule is designed to detect credential phishing attacks that exploit go2.aspx redirects and masquerade as Microsoft-related emails.

Credential phishing content and link (untrusted sender)

Message contains credential theft language and a link to a credential phishing page from an unknown sender. We use Link Analysis in aggressive mode to increase our chances of scanning.

Link: Credential phishing traversing Russian infrastructure

This rule detects credential phishing attempts in emails traversing Russian TLDs by aggressively analyzing links for signs of phishing, including suspicious keywords, login prompts, or links flagged for credential theft, excluding emails from trusted domains unless they fail DMARC verification.

Credential phishing: Engaging language with IPFS link

Body contains credential theft indicators, and contains a link to an IPFS site. IPFS has been recently observed hosting phishing sites.

Credential Phishing via Dropbox comment abuse

This rule detects Credential Phishing attacks exploiting familiar brands via Dropbox comments. These attacks originate from legitimate Dropbox infrastructure and attempt to pivot to external freemail addresses.

Credential phishing: Re-Authentication lure

Contains suspicious links and server-related terminology, requesting email account reauthentication with language targeting recipient credentials.

Link: Credential phishing via WordPress

Detects when non-WordPress senders link to suspended or malicious WordPress blog sites, commonly used to redirect users to credential harvesting pages.

Credential phishing: Generic document sharing

Detects credential phishing attempts using generic document sharing language where the sender claims to have sent a document for review, but the link doesn't point to legitimate file sharing services.

Credential phishing: Suspicious e-sign agreement document notification

Detects phishing attempts disguised as e-signature requests, characterized by common document sharing phrases, unusual HTML padding, and suspicious link text.

Impersonation: DMARC failure with high confidence credential theft intent

Detects DMARC failures and messages with a high confidence of credential theft

Hardbacon infrastructure abuse

Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.

Credential phishing language and suspicious indicators (unknown sender)

Message contains various suspicious indicators as well as engaging language resembling credential theft from an unknown sender.

Attachment: EML with link to credential phishing page

Attached EML links to a credential phishing site or exhibits unusual behavior such as multiple suspicious redirects.

Body: Suspicious date format

Detects messages containing strage date formats observed in phishing emails.

Google Drive abuse: Credential phishing link

This rule detects legitimate Google Drive shares that link to files on Google Drive that host credential phishing content. The file is usually a PDF that impersonates a legitimate brand, with credential theft language, and a button or link to an external site that steals login credentials.

Credential phishing: Engaging language and other indicators (untrusted sender)

Message contains various suspicious indicators as well as engaging language resembling credential theft from an untrusted sender.

Sendgrid onmicrosoft.com domain phishing

The message originates from an onmicrosoft.com email address being sent via Sendgrid.