Skip to content

Create link_susp_html_mirrored_subject.yml#4905

Open
keaton-sublime wants to merge 3 commits into
mainfrom
keaton-sublime.FN.ESC-17231.html_mirror
Open

Create link_susp_html_mirrored_subject.yml#4905
keaton-sublime wants to merge 3 commits into
mainfrom
keaton-sublime.FN.ESC-17231.html_mirror

Conversation

@keaton-sublime

Copy link
Copy Markdown
Member

Description

We're matching messages where the subject is repeated in a few html elements as part of a cred phish lure.

Associated samples

Associated hunts

@keaton-sublime keaton-sublime added the in-test-rules PR is in our testing suite to collect telemetry label Jul 16, 2026
github-actions Bot added a commit that referenced this pull request Jul 16, 2026
…ith subject mirrored in body and single link
github-actions Bot added a commit that referenced this pull request Jul 16, 2026
…TML structure with subject mirrored in body and single link
@keaton-sublime keaton-sublime added the review-needed Indicates that a PR is waiting for review label Jul 17, 2026
@keaton-sublime
keaton-sublime marked this pull request as ready for review July 17, 2026 12:21
@keaton-sublime
keaton-sublime requested a review from a team July 17, 2026 12:21
@keaton-sublime
keaton-sublime requested a review from a team as a code owner July 17, 2026 12:21
@keaton-sublime

Copy link
Copy Markdown
Member Author

marking ready for review/review needed - there's been no additional hits in test rules.

@keaton-sublime
keaton-sublime enabled auto-merge July 17, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant