Phishing Email with Macro Enabled Document

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects phishing emails sent over SMTP that contain macro-enabled documents (Word or Excel files) as attachments. It specifically looks for base64 encoded content, the 'filename=' attribute, and uses a PCRE to identify common macro-enabled file extensions like .doc, .docx, .xls, .xlsm, and .xlsb within the filename.