Sublime Security high experimental mql

Impersonation: DMARC failure with high confidence credential theft intent

Detects DMARC failures and messages with a high confidence of credential theft

View Source

Detection Logic

type.inbound
and any(distinct(headers.hops, .authentication_results.dmarc is not null),
        strings.ilike(.authentication_results.dmarc, "*fail")
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence == "high"
)

Field Validations

Loading…

Comments (0)

Loading comments...