User Execution - Executable Attachment Delivered via Email

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.