Browse Rules

Impersonation: SharePoint reply header anomaly

Detects messages with SharePoint reply headers that lack standard reply characteristics and contain inconsistencies in thread elements and recipient patterns

beta.DLP: Basic Auth Header

Detects messages containing basic authentication headers.

Brand impersonation: Dropbox

Impersonation of Dropbox, a file sharing service.

Brand Impersonation: PayPal

Impersonation of PayPal.

Link: Squarespace infrastructure abuse

Detects inbound messages containing exactly one Squarespace tracking link but lacking authentic Squarespace email headers and sender patterns.

Brand impersonation: Apple

Impersonation of Apple.

Brand impersonation: DocSend

Attack impersonating DocSend.

Brand impersonation: Github

Impersonation of Github.

Brand impersonation: LinkedIn

Impersonation of LinkedIn.

Brand impersonation: Netflix

Impersonation of Netflix.

Brand impersonation: Adobe Sign with suspicious indicators

Detects messages impersonating Adobe Sign that contain Adobe branding elements but are not sent from legitimate Adobe domains and lack proper Adobe Sign authentication headers.

Brand impersonation: Enbridge

Impersonation of the Canadian energy company Enbridge.

Brand impersonation: PNC

Impersonation of PNC Financial Services

Russia return-path TLD (untrusted sender)

The return-path header is a .ru TLD from an untrusted sender.

Brand impersonation: Binance

Impersonation of the cryptocurrency exchange Binance.

Brand impersonation: Norton

Scans files to detect Norton (Lifelock|360|Security) impersonation.

Brand impersonation: DocuSign

Attack impersonating a DocuSign request for signature.

Headers: Fake in-reply-to with wildcard sender and missing thread context

Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.

Brand impersonation: Dashlane

Impersonation of the password management software Dashlane.

Brand impersonation: Google using Microsoft Forms

Abuses Microsoft Forms to impersonate Google.

Brand impersonation: Quickbooks

Impersonation of the Quickbooks service from Intuit.

Brand impersonation: SiriusXM

Impersonation of the broadcasting corporation SiriusXM.

Brand impersonation: Aramco

Impersonation of the petroleum and natural gas company Saudi Aramco.

Link: Microsoft protected message with suspicious recipient patterns

Detects when a user receives a protected message (RPMSG) with the to and from headers matching or there is no TO header at all. Benign matches are possible, sender exclusions can be used to avoid matching on senders which commonly use Microsoft protected messages with suspicious recipient patterns

Brand impersonation: Charles Schwab

Impersonation of Charles Schwab & Co