Sublime Security high experimental mql
Impersonation: Executive using numbered local part
Detects messages from free email providers where the sender's email address uses a pattern commonly associated with executive impersonation, containing 'chair' or 'ceo' followed by numbers in the local part.
Detection Logic
type.inbound
and sender.email.domain.domain in $free_email_providers
and regex.icontains(sender.email.local_part, '^c(?:hair
| eo)\d+')Field Validations
Loading…
Comments (0)
Loading comments...