Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders.

Message contains a link that uses a free subdomain provider, and has a login or captcha on the page.

Detects messages with undisclosed recipients (likely all bcc), where the Compauth verdict is not 'pass', and ML has identified suspicious language or credential phishing links.

Detects fake message threads with suspicious links and financial request language

Message contains various suspicious indicators as well as engaging language resembling credential theft from a first-time sender.

This technique takes advantage of the use of free email services for the reply-to address. By incorporating the sender domain in the local part of the reply-to address, the attacker creates a visually similar appearance to a legitimate email address.

Detects any VBA macro attachment that scores above a medium confidence threshold in the Sublime Macro Classifier.

Message contains a link to a credential phishing page from a first-time sender.

Detects job scam attempts by analyzing the email body text from a first-time sender.

Detects extortion and sextortion attempts by analyzing the email body text from a first-time sender.

Sender is using a display name that matches the display name of someone in your organization.

Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders.

Detects pdf files with links to a remotely hosted password-protected file. This is a common technique abused by Phishing actors as well as Malware actors (IcedID, Remcos, Async Rat)

Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from first-time senders.

Detects callback scams by analyzing text within images of receipts or invoices from first time senders.

Sender is using a display name that matches the display name of someone in your $org_vips list.

Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders.

This detects a pattern commonly observed in mass phishing campaigns.

The local_part or the full email address of the recipient is used in the subject, body, and link query parameter to "personalize" the attack.