← Back to SOC feed Coverage →

Email quota limit warning

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-09T23:00:01Z · Confidence: medium

Hunt Hypothesis

Attackers may use email storage quota warnings to mask the distribution of malicious payloads or phishing content by overwhelming user inboxes, allowing them to evade traditional detection mechanisms. Proactively hunting for this behavior in Azure Sentinel can help identify covert lateral movement or data exfiltration tactics disguised as legitimate email activity.

YARA Rule

rule Email_quota_limit_warning : mail
{
  meta:
		Author = "Tyler Linne <@InfoSecTyler>"
		Description ="Rule to prevent against known email quota limit phishing campaign"
    
  strings:
    $eml_01 = "From:" //Added eml context
    $eml_02 = "To:"
    $eml_03 = "Subject:"
    $subject1={ 44 65 61 72 20 [0-11] 20 41 63 63 6f 75 6e 74 20 55 73 65 72 73 } // Range allows for different company names to be accepted
    $hello1={ 44 65 61 72 20 [0-11] 20 41 63 63 6f 75 6e 74 20 55 73 65 72 73 }
    $body1="You have exceded" nocase
    $body2={65 2d 6d 61 69 6c 20 61 63 63 6f 75 6e 74 20 6c 69 6d 69 74 20 71 75 6f 74 61 20 6f 66 } //Range allows for different quota "upgrade" sizes
    $body3="requested to expand it within 24 hours" nocase
    $body4="e-mail account will be disable from our database" nocase
    $body5="simply click with the complete information" nocase
    $body6="requested to expand your account quota" nocase
    $body7={54 68 61 6e 6b 20 79 6f 75 20 66 6f 72 20 75 73 69 6e 67 20 [0-11] 20 57 65 62 6d 61 69 6c } // Range allows for different company names to be accepted

  condition:
    all of ($eml_*) and
    1 of ($subject*) and 
    1 of ($hello*) and 
    4 of ($body*) 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 12 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/email/Email_quota_limit_warning.yar