Skip to content

Commit 9399af4

Browse files
[PR #3472] modified rule: Attachment: DOCX with hyperlink targeting recipient address
1 parent 2c72a8f commit 9399af4

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

detection-rules/3472_attachment_docx_hyperlink_targeting_recipient.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: "Attachment: DOCX with hyperlink targeting recipient address"
2-
description: "Detects DOCX attachments containing hyperlinks with anchor references that match recipient email addresses from suspicious or malicious senders. This technique is commonly used to personalize malicious documents and evade detection."
2+
description: "Detects DOCX attachments containing hyperlinks with anchor references that match recipient email addresses. This technique is commonly used to personalize malicious documents and evade detection."
33
type: "rule"
44
severity: "medium"
55
source: |
@@ -29,4 +29,4 @@ detection_methods:
2929
id: "d2ff2c1e-2994-5ca2-8bf3-508213e11364"
3030
og_id: "9ec8fa49-bda9-5e8f-876f-1e53a46d83ca"
3131
testing_pr: 3472
32-
testing_sha: 953a091eb9848dec7c876cf8f3cd00576612df2c
32+
testing_sha: b58774820b8211f517a799b27b35a8b7bada4e67

0 commit comments

Comments
 (0)