VIP Spearphish: Distribution Agreement PDF via Google Workspace to Executive
Detects spearphishing emails targeting high-value executive recipients (CEO, CFO, etc.) that contain PDF attachments and use subject lines related to settlement or distribution agreements. The rule specifically looks for inbound traffic routed through Google Workspace (gappssmtp.com) infrastructure, indicating potential use of compromised legitimate domains to distribute malicious lures.
YARA-L
