Service abuse: Filemail file-sharing notifications

calendar Oct 16, 2026  ·
Share on: linkedin copy

Detects legitimate Filemail notification emails abused to deliver file-sharing links, where the reply-to address uses a mismatched domain with a randomized alphanumeric local part, or the notification body references financial lures such as invoices, quotations, purchase orders, or remittance statements. This pattern indicates the free file-sharing service is being leveraged to distribute malicious payloads while evading detection through a trusted sending infrastructure.

Sublime rule (View on GitHub)

 1name: "Service abuse: Filemail file-sharing notifications"
 2description: "Detects legitimate Filemail notification emails abused to deliver file-sharing links, where the reply-to address uses a mismatched domain with a randomized alphanumeric local part, or the notification body references financial lures such as invoices, quotations, purchase orders, or remittance statements. This pattern indicates the free file-sharing service is being leveraged to distribute malicious payloads while evading detection through a trusted sending infrastructure."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and sender.email.email == "no-reply@filemail.com"
 8  and (
 9    any(headers.reply_to,
10        .email.domain.root_domain != "filemail.com"
11        and regex.imatch(.email.local_part, '[a-z]{3,}\d{3,6}')
12    )
13    or any(html.xpath(body.html, '//td[span[normalize-space(text())="Subject:"]]').nodes,
14           regex.icontains(.display_text,
15                           '\b(?:invoice|invoices|estimate|estimates|remittance|statement|statements|purchase order|proforma|billing|payment|receipt|quotation|ach|wire transfer)\b'
16           )
17    )
18  )  
19attack_types:
20  - "Malware/Ransomware"
21  - "BEC/Fraud"
22tactics_and_techniques:
23  - "Free file host"
24  - "Social engineering"
25  - "Spoofing"
26detection_methods:
27  - "Header analysis"
28  - "HTML analysis"
29  - "Content analysis"
30id: "4b3c7b06-054d-5eaf-8a31-479c2dca8ef0"
to-top