Phishing Email Delivering Survey or Form Lure

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects phishing emails that deliver survey or form lures by identifying specific content patterns within SMTP traffic. It looks for emails with 'Content-Type: application/' and 'filename=' headers, specifically targeting attachments with file extensions like .doc, .docx, .pdf, or .xlsx, which are commonly used in social engineering attacks to deliver malicious documents or forms.