Browse Rules

Attachment: HTML smuggling with auto-downloaded file

HTML attachments containing files that are automatically downloaded with Javascript.

[CROWDSTRIKE] Machine Learning Analysis Blocked - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Blocked - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Detected - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Detected - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Killed - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Killed - File Meets File Analysis ML High-Confidence Malware Threshold

Brand impersonation: Dropbox

Impersonation of Dropbox, a file sharing service.

Attachment: Embedded Javascript in SVG file

Javascript inside SVG files can be used to smuggle malicious payloads or execute scripts.

Attachment: File execution via Javascript

Javascript contains identifiers or strings that may attempt to execute files.

Attachment: EML file contains HTML attachment with login portal indicators

Attached EML file contains an HTML attachment with suspicious login indicators. Known credential theft technique.

[CROWDSTRIKE] Machine Learning Analysis Blocked - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Blocked - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Detected - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Detected - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Killed - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Killed - Office File With Macro Written To File System Meets File Analysis ML High-Confidence Malware Threshold

Attachment with auto-opening VBA macro (unsolicited)

Recursively scans files and archives to detect embedded VBA files with an auto open exec.

Attachment: Office document with VSTO add-in

Recursively scans files and archives to detect Office documents with VSTO Add-ins.

Attachment: SVG file execution

Detects file execution attempts in SVG files. ActiveXObject is used to invoke WScript.Shell and run a program.

Suspicious SharePoint file sharing

This rule detect potential credential phishing leveraging SharePoint file sharing to deliver a PDF, OneNote, or Unknown file type file using indicators such as suspicious sender analysis and link characteristics.

Attachment: Emotet heavily padded doc in zip file

Detects a potential Emotet delivery method using padded .doc files that compress into small zip files. Contents may include Red Dawn templates exceeding 500MB.

Attachment: PDF with link to zip containing a wsf file

Detects a PDF attachment with a link to a ZIP file that contains a WSF file

Attachment with encrypted zip (unsolicited)

Recursively scans files and archives to detect encrypted zip files.

Attachment: HTML smuggling with setTimeout

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: PDF file with low reputation link to ZIP file (unsolicited)

Detects messages with PDF attachments linking directly to zip files from unsolicited senders.

Attachment: EML file with HTML attachment (unsolicited)

Detects HTML files in EML attachments from unsolicited senders. Reduces attack surface against HTML smuggling.

Attachment: Embedded VBScript in MHT file

MHT files can be used to run VBScript, which can run malicious code.

Brand impersonation: Norton

Scans files to detect Norton (Lifelock|360|Security) impersonation.

Attachment: HTML attachment with Javascript location

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with atob and high entropy

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.