Emails with Macro-Enabled Documents

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•2

This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.