← All detection heuristics · Social Engineering
high
SE_QR_BUSINESS_PROCESS_LURE
What it means
Document asks the user to scan a QR code for HR, payroll, compensation, signing, or policy workflow.
Why it fires
Business-process QR lures move the malicious destination into the QR image, where normal URL extraction cannot see it. The rule requires both QR-scan language and HR, payroll, compensation, employee-handbook, DocuSign, or signature wording, and the two must appear within 800 bytes of each other so a long benign report that prints a QR code in one section and discusses HR in another does not match. The finding reports how far apart the two cues were.
Other Social Engineering heuristics
SE_BOOKING_COMPLAINT_PHISH PDF_FAKE_DOCUMENT_COMPONENT_INSTALLER OOXML_QR_CREDENTIAL_PHISH SE_CALLBACK_SCAM_TEMPLATE PDF_BRAND_ACCOUNT_UPDATE_REDIRECT_LURE PDF_IMAGE_REPEATED_DECOY_REDIRECT_LURE PDF_IMAGE_DOCUMENT_REVIEW_HOST_LURE PDF_LOCALIZED_DOWNLOAD_HOSTING_LURE PDF_MINIMAL_VIEW_DOCUMENT_REDIRECT PDF_NESTED_ENCODED_CROSSHOST_REDIRECT PDF_RFP_EXTERNAL_ACTION_LURE PDF_UTILITY_REFUND_OFFDOMAIN_LURE PDF_SPARSE_MOVED_ARTICLE_DOORWAY