Material Email Threat Detections

Material Detections protect against numerous attacker tactics and methods. These tactics, techniques, and procedures (TTP) are constantly changing; we update Email Threat Protection often to account for the ever-changing nature of phishing attacks. We send release notes in Slack and update What's New with those changes.

Material Detections are enabled by default. Customize your response and remediation as needed.

Some of the tactics, techniques, and procedures

You can get a visual understanding of what trends look like in your issues in the Email Threats report.

You can filter by these objective and tactics in Issues.

Some of the detections we include are:

Objectives

Credential Theft

• Brand Impersonation: Messages attempting to steal login credentials from the recipient by impersonating a major brand.
• Fake Login Page: Messages attempting to steal login credentials from the recipient by directing them to a malicious URL that impersonates a known identity provider before providing access to the resource.

Fraud and BEC (Business Email Compromise)

• Callback Fraud: Messages containing a fraudulent customer support phone number that leads to a scam call center when dialed.
• Crypto Fraud: Messages advertising a fraudulent cryptocurrency airdrop, giveaway, or pyramid scheme.
• Extortion: Messages attempting to blackmail the recipient, typically by threatening to expose sensitive or embarrassing information and requesting payment in cryptocurrency.
• Gift Card Fraud: Messages attempting to socially engineer the recipient into purchasing gift cards for the sender.
• Invoice Fraud: Messages impersonating a vendor, or sent via a compromised vendor account, that include payment instructions directing funds to a bank account controlled by the attacker.
• Payroll Fraud: Messages impersonating an employee that attempt to socially engineer the recipient to change payroll information to a bank account controlled by the attacker
• PII (Personal, Identifiable, Information) Theft: Messages attempting to socially engineer the recipient into divulging additional contact methods or personal information.

Malware and Ransomware

• Malware Link: Messages that include a link to download a first-stage loader, spyware, infostealer, or other malware from an external website.
• Malware Payload: Messages which include a malicious attachment that will install a first-stage loader, spyware, infostealer, or other malware.
• Ransomware Link: Messages that include a link to download a known ransomware variant from an external website.
• Ransomware Payload: Messages which include a malicious attachment that will install a known ransomware variant when downloaded and opened by the recipient.

Tactics and Techniques

Account Compromise

• Compromised External Sender: A legitimate third-party account that has been hijacked and is being used to send phishing emails, leveraging the trusted reputation of the hijacked account.
• Compromised Internal Sender: An account within the organization that has been hijacked and is being used to send phishing emails, leveraging the trusted reputation of the hijacked account.
• Thread Hijacking: Manipulating the contents of a legitimate email thread to add credibility to the attacker's message or request.

Calendar Invitations

Material flags accounts whose Google Calendar settings add every incoming invitation to the calendar, whoever sent it.

• To view issues created by this detection: filter issues by the detection called Google account automatically adds calendar invitations from everyone.

This detection has no response option, because the fix is a change in your Google Workspace admin console. Learn more about calendar invite attacks and how to change the setting.

Email Bomb Attack

Material automatically detects email bomb attacks and remediates to restore availability to the inbox. You need to enable it separately from email remediation.

• To view issues created by this detection: filter issues by the detection called Account is experiencing a potential email bombing attack .

Learn more about how Email Bomb Protection works and your enablement options here.

External Redirection

• Fraudulent Callback Number: Including a spoofed invoice or notification that contains a fraudulent customer support phone number which leads to a scam call center when dialed.
• Link to Credential Theft URL: Including a link to a malicious webpage that attempts to steal user credentials when visited.
• Link to Free Fileshare Hose: Includes a link to malicious content hosted on a legitimate free filesharing service, such as OneDrive or Dropbox.
• Link to Malware Dropping URL: Including a link to a malicious webpage that automatically downloads unwanted or malicious software when visited.
• Link to Open Redirect: Including a link to a trusted domain (such as LinkedIn) that permits redirects to arbitrary URLs, where the final destination is a malicious webpage.

Legitimate Service Abuse

• Dropbox Notification Abuse: Inserting malicious links or a malicious call to action in the user-editable fields in Dropbox notifications, such as the display name of the sharing account and the name of the shared document.
• Google Drive Notification Abuse: Inserting malicious links or a malicious call to action in the user-editable fields in Google Drive notifications, such as the display name of the sharing account and the name of the shared document.
• Malicious Content on Legitimate Fileshare Services: Inserting a link to a legitimate filesharing service such as OneDrive or Dropbox, where the specific file being shared is malicious when downloaded.
• Paypal Notification Abuse: Inserting malicious links or a malicious call to action into user-editable fields in PayPal notifications, such as the invoice line item and the business name.

Obfuscation

• Content as Image: Embedding text within a static image in the message to evade filters and keyword detection.
• Encrypted Attachment: Use of encryption or password-protecting an attachment to evade security scanners.
• HTML Smuggling: Abuse of HTML and JavaScript features to inject malicious content or code when a document is opened.
• Malicious QR Code: Embedding a QR code in the message that contains a link to a phishing website.
• RTLO Characters: Use of Right-to-Left Override (RTLO) characters to obfuscate the text of a message while still rendering it in a readable way to the recipient.

Social Engineering

• Fake Password Expiration Notification: A fraudulent password expiration notification that leads to a credential-stealing webpage.
• Fake Payment Instructions: An attempt to trick the victim into sending funds to the attacker.
• Fake Storage Limit Notification: A fraudulent cloud storage capacity limit notification that leads to a credential-stealing webpage.
• Fake Voicemail Notification: A fraudulent voicemail notification that leads to a credential-stealing webpage.
• Request for Financial Info: An attempt to trick the victim into providing banking or credit card information.
• Request For PII: An attempt to trick the victim into providing sensitive personal or contact information.
• Urgent Language: Use of language that encourages the victim to act or respond quickly without validating the request.

Spoofing

• Brand Impersonation: Impersonating a well-known brand to trick the victim into opening or interacting with a message.
• Display Name or Subject Spoofing: Impersonating a legitimate sender by changing the display name or subject displayed on the message.
• Employee Impersonation: Impersonating the personal or work email address of a legitimate employee at the organization.
• HR Impersonation: Impersonating the organization's HR department to make the communication appear authoritative and legitimate.
• IT or IdP Impersonation: Impersonating the organization's IT department or identity provider (such as Okta).
• Lookalike Domain: Impersonating a trusted legitimate sender domain by registering an IDN domain or similar-looking domain with homoglyph characters.
• Vendor Impersonation: Impersonating a trusted vendor to trick the victim into providing confidential information or payment details.
• VIP Impersonation: Impersonating an executive or high-profile individual with authority to instruct the victim to perform the attacker's request.