Sublime Security high experimental mql

Link: Self-sender credential theft with configuration placeholder

Detects messages where the sender and recipient are the same address, containing credential theft language and links with configuration placeholder text indicating a phishing lure.

View Source

Detection Logic

type.inbound
// self sender
and length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
and any(body.current_thread.links,
        strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                         '/*──── CONFIG: Replace with your lure URL ────*/'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...