UNC1549 spear-phish: fake Boeing/Airbus career portal (teledyneflir.com.de)
Detects spear-phishing emails associated with UNC1549, utilizing malicious career-themed lures. The rule identifies emails containing specific lookalike domain patterns related to Boeing, Airbus, or Teledyne FLIR, and correlates these with common recruitment-themed email subjects, HR-spoofing sender strings, or the presence of common compressed file attachments (ZIP, RAR, 7Z, ISO).
Splunk (SPL)
