Sublime Security medium experimental mql

Impersonation: Employee name in subject with suspicious sender

Detects inbound messages where the sender is using a free email provider and their display name matches an known organizational display name. The sender's local part contains common organizational role keywords (mail, office, staff, executive), and the subject line matches the recipient's first name or display name, suggesting a targeted impersonation of an internal employee or executive.

View Source

Detection Logic

type.inbound
// suspicious local part
and strings.contains(sender.email.local_part,
                     'mail',
                     'office',
                     'staff',
                     'executive'
)
and (mailbox.first_name == subject.base or mailbox.display_name == subject.base)
and strings.contains(sender.display_name, " ")
and sender.display_name in~ $org_display_names
and sender.email.domain.root_domain in $free_email_providers

Field Validations

Loading…

Comments (0)

Loading comments...