Detect Bulk Phishing Email Distribution

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•2

This rule detects potential bulk phishing email campaigns by identifying a high volume of emails originating from external senders (not @company.com) with suspicious subject lines containing keywords like 'action required', 'verify account', or 'confirm identity'. The rule triggers if at least 50 such emails are sent to 20 or more unique recipients within a one-hour window.