
Summary
This rule detects inbound messages that contain suspicious date formats typical of phishing emails. It examines the textual content of the message body (body.current_thread.text) using a case-insensitive regex to find lines starting with Date: followed by a weekday, a full month name, and a year in the 2025–2029 range. The pattern targets a common calendar/date-invocation cue used in social engineering and evasion tactics, often seen in credential-phishing attempts where impersonation or spoofing is reinforced by a plausible date. When matched, the rule flags potential phishing content for further analysis or remediation. Potential false positives may arise from legitimate calendar invites or dated communications that use similar formatting. The rule operates as a content-analysis check within inbound message processing and is aligned with credential phishing detection objectives.
Categories
- Application
Data Sources
- Script
Created: 2026-04-23