systeme.io lure redirect chain leading away from systeme.io
Detects inbound emails with document-related subjects that contain links to the systeme.io platform, which are subsequently clicked and redirected to a different destination. This pattern is commonly used in phishing campaigns to bypass initial security inspection by leveraging reputable hosting platforms as a redirector.
Microsoft Sentinel (KQL)
