Browse Rules

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure

Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.

Abuse: Robinhood injected content

Detects messages from Robinhood with injected HTML into one of the list fields, often the 'Device' field.

Adobe branded PDF file linking to a password-protected file from untrusted sender

Detects pdf files with links to a remotely hosted password-protected file. This is a common technique abused by Phishing actors as well as Malware actors (IcedID, Remcos, Async Rat)

Advance Fee Fraud (AFF) from freemail provider or suspicious TLD

Advance Fee Fraud (AFF) is a type of BEC/Fraud involving upfront fees for promised future returns, such as lottery scams, inheritance payouts, and investment opportunities. This rule identifies messages from Freemail domains or suspicious TLDS, including those with suspicious reply-to addresses. It utilizes Natural Language Understanding to detect AFF language in their contents.

AnonymousFox indicators

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

Anthropic Magic String in HTML

Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.

Apple state-sponsored attack warning

Detects legitimate Apple threat notifications warning users about potential state-sponsored mercenary attacks targeting their iPhone. These notifications contain specific language about targeted attacks and Apple's confidence level in the warning.

Attachment: 7z Archive Containing RAR File

Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.

Attachment: Adobe image lure in body or attachment with suspicious link

Detects Adobe phishing messages with an Adobe logo in the body or attachment, with suspicious link language.

Attachment: Adobe Sign lure PDF with embedded banner images

Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.

Attachment: Any EML file

Any EML attachment. This rule can be combined with a webhook action for further analysis of attached EML files, eg via the analysis API.

Attachment: Any HTML file (unsolicited)

Potential HTML smuggling attacks in unsolicited messages. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

Attachment: Any HTML file (untrusted sender)

Potential HTML smuggling attacks from new senders. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

Attachment: Any HTML file within archive (unsolicited)

Recursively scans archives to detect HTML files from unsolicited senders. HTML files can be used for HTML smuggling and embedded in archives to evade detection.

Attachment: Any .sap file (unsolicited)

SAP shortcut files can be abused to run unsanctioned code on endpoints. Use if receiving .sap files is not normal behavior in your environment.

Attachment: Archive containing disallowed file type

Recursively scans archives to detect disallowed file types. File extensions can be detected within password-protected archives. Attackers often embed malicious files within archives to bypass email gateway controls.

Attachment: Archive containing HTML file with file scheme link

Attached archive contains an HTML file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.

Attachment: Archive contains DLL-loading macro

An attacker could send a trusted and signed document that references an untrusted DLL file, which will be loaded by the signed document.

Attachment: Archive with embedded CHM file

Recursively scans files and archives to detect embedded CHM (Microsoft Compiled HTML Help) files. According to CERT-UA, on March 7, 2022, phishing attacks targeted state organizations of Ukraine using Zip files with embedded CHM documents, which themselves contained malicious VBScript inside a .htm file. The activity is associated with UNC1151, according to CERT-UA.

Attachment: Archive with embedded EXE file

Recursively scans files and archives to detect embedded EXE files (with an MZ header). According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation". The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.

Attachment: Archive with pdf, txt and wsf files

Detects a known Qakbot delivery method, zip file with pdf, txt and wsf file at a depth of 1

Attachment: Base64 encoded bash command in filename

This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).

Attachment: Calendar file with invisible Unicode characters

Detects calendar (.ics) attachments containing suspicious invisible Unicode characters, which may be used to hide malicious content or bypass security filters. The rule triggers on messages with calendar-related keywords in the subject or body.

Attachment: Calendar invite from recently registered domain

Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.

Attachment: Calendar invite with Google redirect and invoice request

Detects calendar file attachments containing Google redirect URLs in the location field combined with invoice-related language in the message body.