Phishing email delivers .r01 archive masquerading as supply chain PO (LausivLoad
Detects inbound emails containing an '.r01' attachment (often associated with multi-part RAR archives) where both SPF and DMARC authentication checks have failed, and the email subject implies business-related themes like purchase orders or supply chain communication. This pattern is indicative of a spearphishing attempt.
Microsoft Sentinel (KQL)
