Suspicious Archive Attachment Associated with Agent Tesla Delivery

Ankit Mehta@Secvyn

•updated Jun 4, 2026•0•0•5

This rule detects emails containing archive file attachments (zip, rar, 7z). It summarizes the count of such archives per sender, recipient, and file name over a daily period. The rule specifically looks for instances where at least one archive is present in an email.