Attachment: XLS with legal confidentiality disclaimer

calendar Sep 10, 2026  ·
Share on: linkedin copy

Detects inbound emails with XLS attachments containing a specific legal confidentiality disclaimer string commonly found in corporate email signatures. This pattern may indicate a malicious spreadsheet crafted to appear as a legitimate forwarded business communication, lending false credibility to the attachment.

Sublime rule (View on GitHub)

 1name: "Attachment: XLS with legal confidentiality disclaimer"
 2description: "Detects inbound emails with XLS attachments containing a specific legal confidentiality disclaimer string commonly found in corporate email signatures. This pattern may indicate a malicious spreadsheet crafted to appear as a legitimate forwarded business communication, lending false credibility to the attachment."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (.file_extension in~ ("xls"))
 9          and any(file.explode(.),
10                  any(.scan.strings.strings,
11                      strings.contains(.,
12                                       'The information contained in this transmission and its attachments (an "e-communication") are intended solely for the use of the intended recipient(s) and may contain information that is privileged, confidential, proprietary and/or otherwise protected by work product immunity or other legal rules.'
13                      )
14                  )
15          )
16  )  
17attack_types:
18  - "Malware/Ransomware"
19  - "BEC/Fraud"
20tactics_and_techniques:
21  - "Social engineering"
22  - "Macros"
23detection_methods:
24  - "File analysis"
25  - "Content analysis"
26id: "f31995dd-f922-5954-a077-e74c3a3bc287"
to-top