Browse Rules

[ZSCALER-ZIA] Scam destination blocked

[ZSCALER-ZIA] Scam destination blocked

Suspicious display name: Gmail sender with engaging language

Detects Gmail senders using display names with suspicious language patterns commonly associated with social engineering tactics, including urgency indicators, contact requests, and verification prompts.

Attachment: ICS calendar file with recipient address in UID field

Detects inbound messages containing ICS calendar attachments where the UID property matches the recipient's email address, indicating potential calendar-based social engineering.

Brand impersonation: Apple

Impersonation of Apple.

Brand impersonation: Spotify

Impersonation of Spotify.

Brand impersonation: Twitter

Impersonation of Twitter.

Brand impersonation: Vanta

Impersonation of Vanta.

Brand impersonation: Venmo

Impersonation of Venmo

Attachment: PDF with suspicious document view lure

Detects PDF attachments containing a title box designed to lure recipients into viewing a document, a common social engineering technique used to direct users to malicious content.

Link: Shortened URL with fragment matching subject

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

Brand impersonation: DocSend

Attack impersonating DocSend.

Brand impersonation: Github

Impersonation of Github.

Brand impersonation: LinkedIn

Impersonation of LinkedIn.

Brand impersonation: Microsoft

Impersonation of the Microsoft brand.

Brand impersonation: Netflix

Impersonation of Netflix.

Credential theft with 'safe content' deception and social engineering topics

Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust.

Truth Social infrastructure abuse via link redirect

Email contains a Truth Social link (links.truthsocial.com) but does not originate from a Truth Social domain. This is a known malicious tactic.

Brand impersonation: Dashlane

Impersonation of the password management software Dashlane.

Attachment: PDF contains W9 or invoice YARA signatures

PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.

Brand impersonation: Charles Schwab

Impersonation of Charles Schwab & Co

Brand impersonation: DHL

Impersonation of the shipping provider DHL.

Brand impersonation: DigitalOcean

Impersonation of the cloud provider DigitalOcean.

Brand impersonation: Exodus

Attack impersonating Exodus Wallet.

Brand impersonation: FedEx

Impersonation of the shipping provider FedEx.

Brand impersonation: Stellar Development Foundation (SDF)

Attack impersonating Stellar Development Foundation (SDF).