PureLogs: PO26-EMS134.zip Auto-Downloaded from Phishing Page
Detects files with names containing '-EMS' or the specific string 'PO26-EMS134.zip' being created or written to the 'Downloads' directory by common web browsers. This pattern is often associated with phishing campaigns distributing malicious attachments.
Cortex XDR
