Sublime Security medium experimental mql

Impersonation: IT Department mailbox storage alert

Detects inbound messages impersonating an internal IT Department by presenting a fake mailbox storage alert.

View Source

Detection Logic

type.inbound
and strings.contains(body.current_thread.text, 'MAILBOX STORAGE ALERT')
and all([
          'Clean Inbox',
          'Storage Guide',
          'Empty Deleted Items',
          'Clean Mailbox Now',
          'Contact IT Support'
        ],
        . in map(html.xpath(body.html, '//a').nodes, .display_text)
)
and any(body.previous_threads,
        strings.contains(.text, 'IT Department')
        and strings.contains(.text, 'call ext. 5555')
)

Field Validations

Loading…

Comments (0)

Loading comments...