Sublime Security medium experimental mql

Brand spoof: Dropbox

Impersonation of Dropbox, a file sharing service; specifically spoofs the Dropbox sender domain.

View Source

Detection Logic

type.inbound
and sender.email.domain.root_domain == 'dropbox.com'
and not headers.auth_summary.dmarc.pass
// mitigates situations where an ESG misconfiguration could cause auth failures
and not strings.ends_with(headers.message_id, ".dropbox.com>")

Field Validations

Loading…

Comments (0)

Loading comments...