Sublime Security medium experimental mql

Link: Fake video link from newly registered domain

Detects inbound messages from a sender using the local part 'support' whose domain was registered less than 30 days ago, containing a link with a path resembling a video file URL structure ('.mp4/views/').

View Source

Detection Logic

type.inbound
and sender.email.local_part == "support"
and network.whois(sender.email.domain).days_old < 30
and any(body.current_thread.links,
        strings.contains(.href_url.path, ".mp4/views/")
)

Field Validations

Loading…

Comments (0)

Loading comments...