Sublime Security medium experimental mql

Headers: System account impersonation with empty sender address

Detects messages with an empty sender email address and a display name impersonating system accounts like mailer-daemon, postmaster, or administrator, but lacking legitimate bounce back content as determined by natural language processing.

View Source

Detection Logic

type.inbound
and sender.email.email == ""
and (
  strings.icontains(sender.display_name, "mailer-daemon")
  or strings.icontains(sender.display_name, "postmaster")
)
and not (
  (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Bounce Back and Delivery Failure Notifications"
        and .confidence == "high"
    )
    or regex.icontains(subject.subject, 'Undeliver(?:ed
| able)')
    or regex.icontains(subject.subject,
                       'Mensagem não entregue'
    ) // portuguese bounce back variant 
    or regex.icontains(subject.subject,
                       '系统退信'
    ) // chinese bounce back variant 
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...