
Summary
This rule is designed to detect suspicious email subjects that contain long sequences of procedural, nonsensical characters. Such patterns are indicative of phishing or spam attempts, often employed for tracking or evading automatic spam filters. To trigger this rule, the subject must match certain regex criteria, meaning it must include a '#' symbol followed by a combination of letters, numbers, or symbols, but should not exclusively contain letters or numbers. Additionally, the detection logic incorporates a machine learning assessment of the email thread and checks for the context of the sender and the message body to bolster the identification of potentially malicious campaigns. It emphasizes a combination of analysis techniques of both content and sender characteristics to ensure higher accuracy while minimizing false positives that may arise from trusted sources. The rule is classified under a medium severity level, making it an important consideration for email security strategies, particularly against credential phishing and spam tactics.
Categories
- Web
- Cloud
- Endpoint
Data Sources
- User Account
- Application Log
- Network Traffic
Created: 2025-03-12