Browse Rules

Job scam (unsolicited sender)

Detects job scam attempts by analyzing the message body text from an unsolicited sender.

Extortion / sextortion (untrusted sender)

Detects extortion and sextortion attempts by analyzing the email body text from an untrusted sender.

Business Email Compromise (BEC) attempt from unsolicited sender

Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders.

EML attachment with credential theft language (unknown sender)

Identifies EML attachments that use credential theft language from unknown senders.

Credential phishing language and suspicious indicators (unknown sender)

Message contains various suspicious indicators as well as engaging language resembling credential theft from an unknown sender.

Credential phishing: Engaging language and other indicators (untrusted sender)

Message contains various suspicious indicators as well as engaging language resembling credential theft from an untrusted sender.

Extortion / sextortion in attachment from untrusted sender

Detects extortion and sextortion attempts by analyzing attachment text from an untrusted sender.

Credential phishing link (unknown sender)

Message contains a link to a credential phishing page from an unknown sender.

Business Email Compromise (BEC) attempt from untrusted sender

Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from first-time senders.

Google Notification alert link from non-Google sender

This rule detects messages that leverage a link to notifications.google.com not from google and from an untrusted sender. Commonly abused in salesforce phishing campaigns.

Russia return-path TLD (untrusted sender)

The return-path header is a .ru TLD from an untrusted sender.

Brand impersonation: AARP

Detects messages impersonating AARP by analyzing sender display name and body content for AARP references, address information, or survey-related language from unauthorized senders.

Commonly abused sender TLD with engaging language

Message is from a commonly abused sender TLD, contains various suspicious indicators resembling credential theft, and is unsolicited.

Business Email Compromise (BEC) attempt from untrusted sender (French/Français)

Detects potential Business Email Compromise (BEC) attacks by searching for common French BEC language within the email body from first-time senders.

Spam: Firebase password reset from suspicious sender

Detects Firebase password reset messages from suspicious or new senders that may be attempting to abuse the Firebase authentication service.

Suspicious VBA macros from untrusted sender

Detects any VBA macro attachment that scores above a medium confidence threshold in the Sublime Macro Classifier.

Impersonation: Recipient SLD in sender's email address local part

The sender's email address local part contains the recipients SLD, the sender's domain is not a known org domain, and it's an untrusted sender.

Attachment: EML file with HTML attachment (unsolicited)

Detects HTML files in EML attachments from unsolicited senders. Reduces attack surface against HTML smuggling.

Attachment: EML with Sharepoint link likely unrelated to sender

Detects EML attachments containing SharePoint links where the subdomain differs significantly from the sender's domain, potentially indicating SharePoint impersonation or domain spoofing tactics.

Callback phishing in body or attachment (untrusted sender)

Detects callback scams by analyzing text within images of receipts or invoices from untrusted senders.

Link: .onion From Unsolicited Sender

Detects messages containing .onion (Tor network) links from unsolicited senders that either lack proper DMARC authentication or are not from trusted domains.

File sharing link from suspicious sender domain

A file sharing link in the body sent from a suspicious sender domain.

Link: Job recruitment lure from unsolicited sender with suspicious hosting

Message contains job recruitment language with links to suspicious hosting services including free file hosts, subdomain hosts, or URL shorteners from an unsolicited sender.

New sender domain (<=10d) from untrusted sender

Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.

Attachment with auto-executing macro (unsolicited)

Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened. Macros are a common phishing technique used to deploy malware.