Browse Rules

Attachment: Office file with credential phishing URLs

Detects Office documents containing embedded URLs that redirect to credential phishing pages. The rule filters out standard XML namespace and schema URLs commonly found in legitimate Office documents, then analyzes remaining URLs for malicious content using machine learning link analysis.

Spam: URL shortener with short body content and emojis

Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis.

Link: URL shortener with copy-paste instructions and credential theft language

Detects messages containing only URL shorteners with copy-paste instructions and high-confidence credential theft language, typically used to evade URL analysis by requiring manual URL entry.

Link: URL redirecting to blob URL

Detects messages containing links that redirect to blob URLs, indicating potential malware delivery or credential harvesting.

Attachment: PDF with a suspicious string and single URL

Detects single-page PDF attachments containing suspicious language such as 'View Document' or 'View PDF' along with exactly one URL, commonly used in credential theft attacks.

Link: Recipient domain in URL path

This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures.

Link: URL fragment with hexadecimal pattern obfuscation

Detects links containing URL fragments with repeating hexadecimal patterns, commonly used to obfuscate malicious destinations or bypass security filters.

Attachment: HTML smuggling - QR Code with suspicious links

This rule detects messages with HTML attachments containing QR codes

Link: Shortened URL with fragment matching subject

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

Link: Multiple HTTP protocols in single URL

Detects messages containing links with 5 or more HTTP protocol declarations within a single URL, indicating potential URL manipulation or obfuscation techniques.

Attachment: PDF with personal Microsoft OneNote URL

Detects PDF attachments containing a sharepoint URL referencing the senders personal OneNote.

Brand impersonation: Coinbase with suspicious links

Detects messages impersonating Coinbase with low reputation or url shortened links.

URL with Unicode U+2044 (⁄) or U+2215 (∕) characters

Body of the message, or any links, contain the Unicode U+2044 (⁄) or U+2215 (∕) characters inside a URL.

Google services using g.co shortlinks

Identifies messages from authenticated Google domains containing g.co shortened URLs with a subdomain in either the message body links or thread text.

Attachment: ICS file with AWS Lambda URL

Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.

Link: Microsoft Dynamics 365 form phishing

Email body is suspicious, and links to a Microsoft Dynamics form. Known phishing tactic.

Open redirect: Bitrix24 URL Path

Message contains use of the Bitrix24 redirect. This has been exploited in the wild for phishing.

Credential phishing link (unknown sender)

Message contains a link to a credential phishing page from an unknown sender.

Attachment: QR code with credential phishing indicators

Detects messages with between 1-3 attachments containing a QR code with suspicious credential theft indicators, such as: LinkAnalysis credential phishing conclusion, decoded QR code url traverses suspicious infrastructure, the final destination is in URLhaus, decoded URL downloads a zip or executable, leverages URL shorteners, known QR abused openredirects, and more.

PDF attachment with Google (AE) redirecting to a php or zip file

Detects a PDF attachment with a link that contains a Google.ae redirect URL.

Malformed URL prefix

Malformed URL prefix is a technique used to evade email security scanners.

Link: HR impersonation with suspicious domain indicators and credential theft

Detects messages impersonating HR departments containing many links with malformed domains, suspicious TLD patterns, and credential theft language detected through URL analysis.

Link: chatbot.page platform abuse

Detects abuse of chatbot.page where configurations suggest malicious intent, including incomplete contact information, free-tier usage, and suspicious question content.

Open Redirect: Google domain with /url path and suspicious indicators

This rule examines messages containing image attachments that utilize Google's open redirect (google[.]com/url...). To enhance accuracy and minimize false positives, the rule conducts additional assessments for suspicious indicators, as indicated in the comments.

Attachment: Office document with VSTO add-in

Recursively scans files and archives to detect Office documents with VSTO Add-ins.