TA4922 Spearphishing - GoFile/MediaFire/LimeWire Archive Delivery with HR or Tax Lures

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.