Icarus Extortion Email with Cryptocurrency Demand and Breach Threat Language
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Sigma
