Sublime Security medium experimental mql

Mass Outbound Group With Free File Host Domain

Detects when a sender contacts multiple unique domains and includes links to known free file hosting services.

View Source

Detection Logic

type.outbound
and 1 of (
  length(distinct(recipients.to, .email.domain.root_domain)) > 10,
  length(distinct(recipients.cc, .email.domain.root_domain)) > 10,
  length(distinct(recipients.bcc, .email.domain.root_domain)) > 10
)
and any(body.links, .href_url.domain.domain in $free_file_hosts)

Field Validations

Loading…

Comments (0)

Loading comments...