Sublime Security high experimental mql

AnonymousFox indicators

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

View Source

Detection Logic

type.inbound
and (
  any(headers.hops,
      any(.fields,
          strings.istarts_with(.name, "X-Authenticated-Sender", "X-Sender")
          and regex.icontains(.value, "(anonymous
| smtp)fox-")
      )
  )
  or regex.icontains(sender.email.email, "(anonymous
| smtp)fox-")
)

Field Validations

Loading…

Comments (0)

Loading comments...