UNC1549 spearphishing via fake teledyneflir.com.de recruitment portal

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•6

This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).