Browse Rules

Credential phishing link (unknown sender)

Message contains a link to a credential phishing page from an unknown sender.

Link: Microsoft Dynamics 365 form phishing

Email body is suspicious, and links to a Microsoft Dynamics form. Known phishing tactic.

Attachment: HTML smuggling - QR Code with suspicious links

This rule detects messages with HTML attachments containing QR codes

Link: Spam website with evasion indicators

Detects messages containing links to spam websites that show signs of evasion techniques, including blocklisted IP provider messages or rate limiting responses when analyzed.

Link: HR impersonation with suspicious domain indicators and credential theft

Detects messages impersonating HR departments containing many links with malformed domains, suspicious TLD patterns, and credential theft language detected through URL analysis.

Link: Unsolicited email contains link to page containing Tycoon URI structure

Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.

Link: Credential phishing link with undisclosed recipients

This rule detects messages with "Undisclosed Recipients" that contain a link to a credential phishing page.

Link: Multistage landing - Trello board abuse

Detects suspicious Trello board links containing malicious indicators such as credential theft content, blocked users, malicious attachments, or boards with minimal content from unsolicited senders.

Link: chatbot.page platform abuse

Detects abuse of chatbot.page where configurations suggest malicious intent, including incomplete contact information, free-tier usage, and suspicious question content.

Suspicious recipients pattern with no Compauth pass and suspicious content

Detects messages with undisclosed recipients (likely all bcc), where the Compauth verdict is not 'pass', and ML has identified suspicious language or credential phishing links.

Credential phishing content and link (untrusted sender)

Message contains credential theft language and a link to a credential phishing page from an unknown sender. We use Link Analysis in aggressive mode to increase our chances of scanning.

Link: Multistage landing - FreshDesk knowledge base abuse

Detects messages containing links to Freshdesk support solution pages that redirect to external domains with credential theft language, excluding legitimate Freshworks domains and organizational domains.

Attachment: QR code with credential phishing indicators

Detects messages with between 1-3 attachments containing a QR code with suspicious credential theft indicators, such as: LinkAnalysis credential phishing conclusion, decoded QR code url traverses suspicious infrastructure, the final destination is in URLhaus, decoded URL downloads a zip or executable, leverages URL shorteners, known QR abused openredirects, and more.

Link: Microsoft device code authentication with suspicious indicators

Detects messages containing links with Microsoft device code authentication patterns, including verification prompts, copy code instructions, and suspicious API endpoints or antibot tokens commonly used in device code takeover attacks.

Free subdomain link with credential theft indicators

Message contains a suspicious Recipients pattern, a link that uses a free subdomain provider, and has credential theft language on the linked page.

Link to auto-downloaded file with Adobe branding

A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.

Link to auto-downloaded file with Google Drive branding

A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.

Link: Credential harvesting with excess padding evasion

Detects inbound messages containing credential-related action links with tall screenshot images and HTML padding techniques used to evade detection. The rule identifies messages with excessive empty div tags, non-breaking spaces, or large margin-top values that artificially increase content height while hiding malicious intent.

Google Accelerated Mobile Pages (AMP) abuse

This rule is designed to identify phishing attempts abusing Google AMP's URL structure for malicious activities. The rule aims to detect specific URL patterns, further analyzing both message content, as well as the destination of the link to distinguish between legitimate Google AMP pages and potential malicious usage.

Attachment: EML with link to credential phishing page

Attached EML links to a credential phishing site or exhibits unusual behavior such as multiple suspicious redirects.

Attachment: PDF with suspicious link and action-oriented language

Detects PDF attachments containing a single link that leads to pages with language prompting users to view, review, or read documents, accounts, or business-related content such as bids, proposals, agreements, or contracts.

Link: Credential theft with invisible Unicode character in page title from unsolicited sender

Detects messages containing credential theft language and links to pages with invisible Unicode characters in the title tag, a technique commonly used to evade detection in fraudulent pages.

Suspicious recipient pattern and language with low reputation link to login

Message contains a suspicious recipient pattern, financial or urgent language, and a suspicious link, with a login page and confusable characters or multiple redirects.

Service abuse: Formester with suspicious link behavior

Detects abuse of the Formester form service where links either redirect to credential phishing pages, contain suspicious top-level domains in the final DOM and/or redirect history, or display 'secure message' text indicating potential credential theft.

Link: Multistage landing - Scribd document

Detects when a Scribd document contains embedded links that are suspicious, particularly those targeting Microsoft services through various evasion techniques. The rule analyzes both the document content and linked destinations for suspicious patterns and redirects.