Sublime Security low experimental mql

Anthropic Magic String in HTML

Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.

View Source

Detection Logic

type.inbound
and length(attachments) <= 3
and (
  strings.icontains(body.html.raw, 'ANTHROPIC_MAGIC_STRING_')
  or strings.icontains(body.plain.raw, 'ANTHROPIC_MAGIC_STRING_')
  or strings.icontains(body.html.display_text, 'ANTHROPIC_MAGIC_STRING_')
  or any(attachments,
         any(file.explode(.),
             strings.icontains(.scan.ocr.raw, "ANTHROPIC_MAGIC_STRING_")
             or strings.icontains(.scan.strings.raw, "ANTHROPIC_MAGIC_STRING_")
         )
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...