High Volume of Compressed Attachments in Emails

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.