Detect Phishing Emails with URL Redirects

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects potential phishing attempts by identifying emails with URLs that originate from outside the internal company domain (@company.com). It specifically looks for emails where the subject line contains keywords like 'click', 'confirm', or 'update', and where multiple such emails (3 or more) are sent from the same external sender to the same recipient.