Email Link to Known Malicious Domains - APT34

Andrea Cuore@ZeroDayGlow

•updated Jul 9, 2026•15•0•21

This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.