Sublime Security medium experimental mql
Impersonation: IT Department mailbox storage alert
Detects inbound messages impersonating an internal IT Department by presenting a fake mailbox storage alert.
Detection Logic
type.inbound
and strings.contains(body.current_thread.text, 'MAILBOX STORAGE ALERT')
and all([
'Clean Inbox',
'Storage Guide',
'Empty Deleted Items',
'Clean Mailbox Now',
'Contact IT Support'
],
. in map(html.xpath(body.html, '//a').nodes, .display_text)
)
and any(body.previous_threads,
strings.contains(.text, 'IT Department')
and strings.contains(.text, 'call ext. 5555')
) Field Validations
Loading…
Comments (0)
Loading comments...