The recipient's domain is used in the sender's display name in order to impersonate the organization. The impersonation has been observed to use both the recipient's full email address, as well as just the domain.

Impersonation of PayPal.

Impersonation of the shipping provider DHL.

Impersonation of Github.

Impersonation of Amazon. These are most commonly fake shipping notifications. Amazon is the #2 most-impersonated brand (as of Q2 2020)

Impersonation of Vanta.

Detects Zimbra originated emails sent from non-supported Windows versions. Observed in widespread HTML credential phishing campaigns.

Impersonation of Netflix.

Impersonation of the TurboTax service from Intuit. Most commonly seen around US tax season (Q1).

Impersonation of Blockchain[.]com, usually for credential theft.

Impersonation of Spotify.

Impersonation of Facebook.

Sender is using a display name that matches the display name of someone in your organization.

Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders.

Detects job scam attempts by analyzing the email body text from a first-time sender.

Impersonation of Twitter

Impersonation of the video conferencing provider Zoom. This "strict" version of this rule will only flag when the sender's display name matches those used by Zoom exactly.

Detects inbound emails where the sender domain is less than 7 days old from first-time senders.

Attachment contains a VBA macro from a sender your organization has never sent an email to.

Sender is using a display name that matches the display name of someone in your organization.

VBA macros are a common phishing technique used to deploy malware.

Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from first-time senders.

Sender is using a display name that matches the display name of someone in your $org_vips list.

Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders.

Abuses Microsoft Forms to impersonate Google.

Possible attempt to impersonate Sublime Security executives.

Impersonation of Wells Fargo Bank.

Impersonation of the payroll provider ADP. Most commonly seen around US tax season (Q1)

Impersonation of the credit card provider American Express.

Impersonation of Apple.

Impersonation of Bank of America, usually for credential theft.

Impersonation of Chase Bank and related services to harvest credentials or related information such as dates of birth, phone numbers, social security numbers, ATM pin numbers, drivers license numbers, selfies, and ID card photos.

Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials or related information.

Impersonation of the cloud provider Digital Ocean.

Impersonation of the shipping provider FedEx.

Impersonation of the Financial Industry Regulatory Authority (FINRA)

Impersonation of LinkedIn.

Impersonation of the Microsoft brand.

Impersonation of Outlook.com. Senders with "outlook.com" in the subdomain have been observed sending fake account notifications.

Impersonation of ukr[.]net.

Originally reported by CERT-UA on 07 March, 2022, phishing emails impersonate ukr[.]net to steal user credentials. "Compromised mailboxes are used by the Russian Federation's special services to conduct cyber attacks on citizens of Ukraine."

Impersonation of Venmo

Sender is using a disposable email service and no one in our organization has ever sent them an email.

A file sharing link in the body sent from a suspicious sender domain.

Sender's domain is a lookalike of one of your organization's domains.

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

An email from Sharepoint Online that was sent to multiple recipients that did not originate from a sender, by display name, in your organization.