Detonation Enrichment And Ml Signals

Operator references a link-detonation / sandbox verdict in a rule to catch credential-harvesting pages behind benign-looking URLs.

Read the documented detonation verdict field and treat it as one signal among several — a clean verdict is not proof of safety (cloaking, geofencing, time-bombed redirects evade sandboxes), and a malicious verdict is high-value. Combine with sender/auth context. Account for verdicts that arrive asy…

Operator references a domain-age / sender-reputation enrichment to weight a first-contact message, treating a brand-new domain as a strong risk factor.

Use reputation/age enrichment as a risk weight, not a verdict: a newly-registered domain combined with financial-language and a first-time external sender is high risk, but new-domain alone false-positives on legitimate new vendors. Combine enrichments rather than thresholding one. [REQUIRES-VERIFI…

An attachment is a macro-enabled document that only detonates its payload when opened on a domain-joined host. The sandbox sees benign behavior.

Combine the file-detonation verdict with static/structural signals (macro presence, suspicious auto-exec, sender risk) so an evasion-aware payload that sandboxes clean is still caught by corroborating signals. Do not treat a clean sandbox run as exoneration for a structurally-suspicious file from a…