PDF Lure 'Distribution Settlement Agreement' Credential Harvesting via Email
Detects incoming emails with specific subject lines or attachment names relating to 'distribution settlement agreement' or 'agreement settlement' that arrive as PDF attachments. The rule calculates a risk score based on sender domain reputation (known malicious), DMARC/DKIM authentication mismatches, and potential display name spoofing to identify phishing attempts.
Splunk (SPL)
