Sublime Security high experimental mql

Brand impersonation: Apple

Impersonation of Apple.

View Source

Detection Logic

type.inbound
and (
  sender.display_name =~ 'apple developer'
  or strings.ilevenshtein(sender.display_name, 'apple developer') <= 2
)
and sender.email.domain.root_domain !~ 'apple.com'
and sender.email.email not in $recipient_emails

Field Validations

Loading…

Comments (0)

Loading comments...