Spearphishing Email with Office Attachment

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.