7 · Webmail response (HIGH + MEDIUM). A mock Gmail message. BDR checks links + attachments. Expected: HIGH for the phishing link (look-alike of microsoft) + MEDIUM for the .exe attachment.
From: security@paypa1-alerts.com · To: you@corp.com
Your account is on hold — verify now
We detected unusual activity. Please confirm your details: