UNC6692 Email Flood Vishing Precursor – 100+ Emails in 60s

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.