Sublime Security low experimental mql

Attachment: Any HTML file (unsolicited)

Potential HTML smuggling attacks in unsolicited messages. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in~ ('htm', 'html') or .file_type == "html"
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign

// negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Field Validations

Loading…

Comments (0)

Loading comments...