LegionLoader-Gasparinutrition Phishing PDF Drop via Email Client

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects endpoint file creation or modification events involving PDF files with suspicious, lure-like filenames (e.g., 'Settlement Agreement') being written by email clients or web browsers. This rule acts as a proxy for identifying potential spearphishing attachment execution on the endpoint.