Sublime Security medium experimental mql

Brand impersonation: Silicon Valley Bank

Detects emails that impersonate Silicon Valley Bank

View Source

Detection Logic

type.inbound
and (
  regex.icontains(sender.email.domain.domain,
                  "(silicon(e)?.{0,10}(valley
| bank)
| svb)"
  )
  or strings.ilevenshtein(sender.display_name, 'svb') <= 1
)
and network.whois(sender.email.domain).days_old <= 30

Field Validations

Loading…

Comments (0)

Loading comments...