Gmail legal-lure phishing with short.gy shortlink bypassing SPF/DKIM/DMARC
Detects incoming emails containing suspicious legal-themed subjects (e.g., subpoenas, copyright infringement) from Gmail domains that include shortened URLs (e.g., bit.ly, goo.gl). The rule also checks for successful SPF or DKIM authentication results, which are common in mass phishing campaigns to bypass initial spam filters.
Splunk (SPL)
