Skip to content

Conversation

@ben-sublime
Copy link
Contributor

@ben-sublime ben-sublime commented Aug 12, 2025

Description

Detects messages impersonating Charter Spectrum by using variations of 'Spectrum' or 'MyCharter' in the display name while not originating from legitimate Charter domains or failing DMARC authentication.

Associated samples

Associated hunts

@ben-sublime ben-sublime requested a review from a team as a code owner August 12, 2025 13:44
@ben-sublime ben-sublime added the in-test-rules PR is in our testing suite to collect telemetry label Aug 12, 2025
Added an exception for a third party mailer, ccsend.com
Reduced ccsend.com domain to root domain instead of spectrumbusiness.ccsend.com
Missed a comma in an array
Found additional exclusions for domains and special handling for spectrum.com and spectrum.net
@ben-sublime ben-sublime marked this pull request as draft August 15, 2025 14:57
github-actions bot added a commit that referenced this pull request Aug 15, 2025
@ben-sublime ben-sublime marked this pull request as ready for review August 19, 2025 13:35
@ben-sublime ben-sublime added the review-needed Indicates that a PR is waiting for review label Aug 25, 2025
github-actions bot added a commit that referenced this pull request Aug 26, 2025
@zoomequipd zoomequipd removed the review-needed Indicates that a PR is waiting for review label Sep 4, 2025
@MSAdministrator
Copy link
Member

/update-test-rules

@zoomequipd
Copy link
Member

/update-test-rules

alex-herold and others added 2 commits October 28, 2025 07:59
- Applied .github directory from main to ben-sublime-patch-3
- Ensures workflows and GitHub configurations are up to date
- Automated sync via script
github-actions bot added a commit that referenced this pull request Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants