Once in a BlueMoon: Phishing Sender Email Hunt (BlueMoon Exploit Chain)

Ankit Mehta@Secvyn

•updated Sep 9, 2026•2•0•4

This rule monitors incoming emails by cross-referencing sender addresses against a hardcoded list of known malicious or suspicious email accounts. It associates these emails with any potential attachments to provide context for further investigation.