Sublime Security medium experimental mql

Abuse: Robinhood injected content

Detects messages from Robinhood with injected HTML into one of the list fields, often the 'Device' field.

View Source

Detection Logic

type.inbound
and sender.email.email == "noreply@robinhood.com"
and any(html.xpath(body.html, '//div/ul[count(li) = 4]/li').nodes,
        length(.raw) > 500 and strings.count(.raw, "</") > 10
)

Field Validations

Loading…

Comments (0)

Loading comments...