Sublime Security medium experimental mql

Body: Suspicious date format

Detects messages containing strage date formats observed in phishing emails.

View Source

Detection Logic

type.inbound
and regex.icontains(body.current_thread.text,
                    'Date:\s(?:Sunday
| Monday
| Tuesday
| Wednesday
| Thursday
| Friday
| Saturday)\s(?:January
| February
| March
| April
| May
| June
| July
| August
| September
| October
| November
| December)\s202(?:5
| 6
| 7
| 8
| 9)'
)

Field Validations

Loading…

Comments (0)

Loading comments...