Phishing for Information via Spray Pattern & Sender/Reply-To Mismatch (T1598)

Arnold Chan@slaz

•updated Aug 27, 2026•1•0•5

This rule detects potential phishing activity by identifying bulk email campaigns (5 or more recipients) where either the email subject contains known suspicious keywords (e.g., 'password', 'urgent', 'invoice') or the Reply-To address domain differs from the sender domain. The rule specifically excludes emails with attachments or URLs, focusing on social engineering pretexts that aim to initiate a conversation or gather information without external payloads.