Sublime Security medium experimental mql

Link: Apple App Store malicious ad manager themed apps from free email provider

Detects messages containing Apple App Store links with sent from free email providers, indicating potential abuse of legitimate Apple services hosting malicious ad manager themed applications.

View Source

Detection Logic

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain in ('apps.apple.com')
        and regex.icount(.href_url.path,
                         '[/-](?:suite
| ads?
| manager?
| campaigns?)'
        ) >= 2
)
and sender.email.domain.domain in $free_email_providers

Field Validations

Loading…

Comments (0)

Loading comments...