Screening Serpens - Filemail API Payload Drop

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•7

This rule detects outbound network requests to the Filemail API (specifically '2117.filemail.com/api/file/get') followed by the dropping of a ZIP archive within a 10-minute window by the same initiating process on the same device. This behavior is indicative of the 'Screening Serpens' threat activity, where adversaries use legitimate web services like Filemail to deliver malicious payloads.