Social engineering heuristics

13 detection rules

← All detection heuristics

Booking.com complaint phishing lure critical SE_BOOKING_COMPLAINT_PHISH
A Booking.com guest-complaint lure sends its review action to an unrelated domain.
Fake document component prompt delivers installer critical PDF_FAKE_DOCUMENT_COMPONENT_INSTALLER
An Adobe/PDF compatibility prompt links to an installer or remote-management agent.
OOXML QR credential-phishing lure critical OOXML_QR_CREDENTIAL_PHISH
An embedded QR URL is paired with a scan/sign-in/document-access lure.
Unresolved callback-scam template critical SE_CALLBACK_SCAM_TEMPLATE
An unauthorized-payment callback lure contains unresolved campaign placeholders.
Branded account-update lure redirects externally high PDF_BRAND_ACCOUNT_UPDATE_REDIRECT_LURE
A branded account-lock or payment warning uses a non-brand destination.
Image document repeats decoy text over a redirect high PDF_IMAGE_REPEATED_DECOY_REDIRECT_LURE
An image-heavy PDF repeats a machine-readable decoy layer while redirecting externally.
Image-only document-review lure on unrelated host high PDF_IMAGE_DOCUMENT_REVIEW_HOST_LURE
An image-only document carrier links to a host named like a review, signing, or sharing service.
Localized file-download lure uses external hosting high PDF_LOCALIZED_DOWNLOAD_HOSTING_LURE
A localized download/view instruction points to object storage or an unrelated host.
Minimal view-document carrier redirects externally high PDF_MINIMAL_VIEW_DOCUMENT_REDIRECT
A content-free view/open-document carrier links through tracking, preview, or user hosting.
Nested encoded cross-host PDF redirect high PDF_NESTED_ENCODED_CROSSHOST_REDIRECT
A PDF link hides a different destination host behind multiple percent-encoding layers.
RFP directs recipients to an external workflow high PDF_RFP_EXTERNAL_ACTION_LURE
A request-for-proposal CTA uses an external form or document workflow.
Utility refund notice links off-domain high PDF_UTILITY_REFUND_OFFDOMAIN_LURE
A utility overpayment or refund notice directs the recipient to unrelated hosting.
Sparse moved-article redirect doorway medium PDF_SPARSE_MOVED_ARTICLE_DOORWAY
A nearly empty PDF says an article moved and supplies one external action.