Sublime Security low experimental mql

Link: .onion From Unsolicited Sender

Detects messages containing .onion (Tor network) links from unsolicited senders that either lack proper DMARC authentication or are not from trusted domains.

View Source

Detection Logic

type.inbound
and any(body.links, .href_url.domain.tld == "onion")
and not profile.by_sender_email().solicited
// and the sender is not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Field Validations

Loading…

Comments (0)

Loading comments...