[IC] - Catching Emojis into Email Attachment Files names
Attackers take advantage of the emojis because they help the content stand out and gets more attention than plain text. It not apply just to Email Subject if not that it also applies to Attachment Files which based on my experience, legitime file not use to have icons in their file names.For example: 📄Invoice.pdf 🔐Reset_Password.html 📦Delivery_Document.zip This can help find: - Suspicious files dropped on emails - Files downloaded from phishing emails - User-downloaded /opening scam files - Payloads with social engineering names
Microsoft Sentinel (KQL)
