Sublime Security high experimental mql
Headers: Fake in-reply-to with wildcard sender and missing thread context
Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.
Detection Logic
type.inbound
and headers.in_reply_to is not null
and not (subject.is_forward or subject.is_reply)
and length(body.previous_threads) == 0
and strings.count(sender.email.local_part, "*") >= 2Field Validations
Loading…
Comments (0)
Loading comments...