Browse Rules

Employee impersonation: Payroll fraud

This rule detects messages impersonating employees, from unsolicited senders attempting to reroute payroll or alter payment details.

BEC: Employee impersonation with subject manipulation

Subject matches the display name of someone in your organization, and the body resembles a BEC attack.

Impersonation: IT Department mailbox storage alert

Detects inbound messages impersonating an internal IT Department by presenting a fake mailbox storage alert.

Impersonation: Employee name in subject with suspicious sender

Detects inbound messages where the sender is using a free email provider and their display name matches an known organizational display name. The sender's local part contains common organizational role keywords (mail, office, staff, executive), and the subject line matches the recipient's first name or display name, suggesting a targeted impersonation of an internal employee or executive.

Employee impersonation with urgent request (untrusted sender)

Sender is using a display name that matches the display name of someone in your organization. Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body from untrusted senders.

VIP impersonation with charitable donation fraud

Fake email thread shows a VIP requesting a donation to a charity, usually addressed to Accounts Payable departments. Can result in monetary loss.

Xero invoice abuse

Detects suspicious Xero invoice communications containing urgent payment requests where the sender's display name contains either confusable characters or impersonates internal services like HR or IT support.

Suspicious request for financial information

Email is from a suspicious sender and contains a request for financial information, such as AR reports.

Impersonation: Human Resources with link or attachment and engaging language

Detects messages impersonating HR that contain at least 1 link or 1 attachment with engaging language in the body from an untrusted sender.

Attachment with VBA macros from employee impersonation (unsolicited)

Attachment contains a VBA macro from a sender your organization has never sent an email to. Sender is using a display name that matches the display name of someone in your organization. VBA macros are a common phishing technique used to deploy malware.

Link: HR impersonation with suspicious domain indicators and credential theft

Detects messages impersonating HR departments containing many links with malformed domains, suspicious TLD patterns, and credential theft language detected through URL analysis.

Canva infrastructure abuse

A fraudulent invoice/receipt found in the body of the message sent by exploiting Canva's design sharing feature.

Service Abuse: Box file sharing with credential phishing intent

Detects abuse of Box's legitimate infrastructure for credential phishing attacks.

Impersonation: Internal corporate services

Detects phishing attempts that impersonate corporate services such as HR, helpdesk, and benefits, using specific language in the subject or sender's name and containing suspicious links from low-reputation or mass-mailing domains.

Impersonation: Employee using fabricated identity in initial contact

Detects inbound messages that appear to be initial contact attempts where the sender uses a display name that doesn't match their email address, includes basic greetings referencing the subject line, and signs off with their display name. The message is short with no attachments, suggesting a social engineering setup for further communication.

Headers: System account impersonation with empty sender address

Detects messages with an empty sender email address and a display name impersonating system accounts like mailer-daemon, postmaster, or administrator, but lacking legitimate bounce back content as determined by natural language processing.

Link: SharePoint filename matches org name

Detects messages claiming to share files via SharePoint or OneDrive where the shared file name pattern matches the organizational naming pattern, indicating potential abuse of legitimate file sharing services to impersonate organizations.

VIP Impersonation via Google Group relay with suspicious indicators

Public Google Groups can be used to impersonate internal senders, while the reply to address is not under organizational control, leading to fraud, credential phishing, or other unwanted outcomes.

Benefits enrollment impersonation

Detects messages about benefit enrollment periods and healthcare selections from external senders that contain urgent language or requests for action. Excludes legitimate HR communications, marketing mailers, and trusted sender domains with valid authentication.

Suspicious attachment with unscannable Cloudflare link

A PDF or Office document contains suspicious URLs that lead to Cloudflare-protected pages with turnstile CAPTCHA gates. The sender uses deceptive display names and subjects indicating urgency or authority.

Credential phishing: Generic document sharing

Detects credential phishing attempts using generic document sharing language where the sender claims to have sent a document for review, but the link doesn't point to legitimate file sharing services.

CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule

"This rule detects medium-severity social threat alerts from CYFIRMA related to impersonation, fake profiles, or malicious activities on social platforms that may target executives, brands, or employees. These threats can result in reputational damage, phishing, or social engineering attacks. Immediate investigation and takedown are recommended to minimize risk."

CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule

"This rule detects high-severity social threat alerts from CYFIRMA related to impersonation, fake profiles, or malicious activities on social platforms that may target executives, brands, or employees. These threats can result in reputational damage, phishing, or social engineering attacks. Immediate investigation and takedown are recommended to minimize risk."

Sharepoint link likely unrelated to sender

Detects when a sender links to a Sharepoint file where the subdomain significantly differs from the sender's domain. The rule checks for OneNote, PDF, or unknown file types and includes various domain validation checks.

Sender: Local part built from recipient domain and mailbox

Flags inbound messages where the sender's local part is constructed by combining the recipient's domain name and mailbox name (e.g., domain_mailbox). This pattern is commonly used to make the sender address appear related to or originating from the recipient's own organization, helping the message blend in and evade scrutiny.