StyleSmuggler: Magento Payment Failed Reminder email RCE trigger
This rule detects a correlation between an email phishing burst (high volume of emails with a specific failed payment subject) and the subsequent creation of suspicious 'x_trace_' files in 'var/report/' directories. This pattern is indicative of a phishing campaign where a malicious attachment or link might be attempting to write local tracking or diagnostic files on a victim's host.
Microsoft Sentinel (KQL)
