Legal-Themed Phishing via Gmail with URL Shortener and Law Firm Impersonation
Detects incoming phishing emails sent from personal Gmail accounts that attempt to impersonate law firms by using legal-themed subjects (e.g., lawsuits, subpoenas, cease and desist). The rule specifically identifies the use of URL shorteners commonly used to obfuscate credential-harvesting destinations. The detection relies on email metadata and subject line patterns to identify potential spearphishing attempts.
YARA-L
