SEKOIA.IO Rules medium stable sigma

Suspicious Email Attachment Received

Detects email containing a suspicious file as an attachment, based on its extension.

View Source

Detection Logic

email:
  email.from.address: "*"
file:
  file.name
| endswith:
    - .bat
    - .dll
    - .exe
    - .hta
    - .library-ms
    - .ps1
    - .rdp
email_attachment:
  email.attachments.file.extension:
    - bat
    - dll
    - exe
    - hta
    - library-ms
    - ps1
    - rdp
filter:
  event.action:
    - discard
    - reject
condition: (email and file) or (email_attachment and not filter)

Field Validations

Loading…

Comments (0)

Loading comments...