(Qradar Rules): Engineering a Phishing Detection Rule Using Trend Micro log source

Step1: Rule Objective

• Detect phishing attempts identified by Trend Micro
• Focus only on phishing-related URLs
• Reduce false positives caused by quarantined or blocked emails
• Identify phishing campaigns targeting multiple users

Step2: Detection Scope

• The rule applies only to events detected by the LOCAL system
• Log source: Trend Micro ScanMail
• Detection is based on specific phishing-related QIDs

Step3: QID Filtering Logic

Included QIDs

• Suspicious URL not blocked
• Suspicious URL — Not Block

These indicate the phishing attempt was detected but not prevented.

Get Ayoub’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Excluded QIDs

• Suspicious Mail — Moved to Junk
• Suspicious Mail — Quarantined
• Suspicious URL — Quarantined

Step4: Threat Category Validation

• The event must contain Threat Category = Phishing
• Ensures detection focuses strictly on phishing techniques
• Avoids triggering on other malware categories

This adds semantic validation beyond QID matching.

Step5: Threat Category Validation

• The event must contain Threat Category = Phishing
• Ensures detection focuses strictly on phishing techniques
• Avoids triggering on other malware categories

This adds semantic validation beyond QID matching.

APPLY IEX_PHI.1-A4-1_A-TA0001.T1566.002-AG1_EP_Phishing attempt detection (Trend Micro) on events which are detected by the LOCAL system

AND when the event(s) were detected by one or more of Trend Micro Scan Mail

AND when the event QID is one of the following (1004000003) Suspicious URL not blocked, (1004500015) Suspicious URL - Not Block

AND NOT when the event QID is one of the following (1004500019) Suspicious Mail - Moved to Junk Email, (1004500018) Suspicious Mail - Quarantined, (1004500016) Suspicious URL - Quarantined

AND when the event matches Threat Category (custom) contains any of Phishing

AND when the event matches URL (custom) is not N/A

AND NOT when the event matches URL (custom) matches any of expressions \/.*\.(jpg|png|bmp)$

AND when the event matches URL NOT ilike '%LinkID%' AND URL NOT ilike '%track%' AND URL NOT ilike '%sendgrid%' and URL NOT ilike '%@%' and URL NOT ilike '%email%' and URL NOT ilike '%newsletters%' and URL NOT ilike '%gamestop%' AND URL NOT ilike '%figbytes%' AQL filter query

AND NOT when any of Source_Domain (custom) are contained in any of SourceDomainWhitelist - AlphaNumeric

AND when at least 5 events are seen with the same URL (custom) and different Recipients (custom) in 24 hour(s)

Good Luck!