Inbound Email Containing Proton Drive Links - DeviceCode phish

F S@Fsdr

•updated Jul 7, 2026•22•1•42

Detects inbound or intra-organizational emails that contain URLs associated with Proton Drive services. This rule is specifically designed to identify potential device code phishing attempts or malicious document distribution utilizing Proton Drive's infrastructure.