Sublime Security medium experimental mql

PHP Mailer with common phishing attachments

Mail coming from a PHP Mailer user agent that includes attachments with commonly used names in phishing campaigns

View Source

Detection Logic

type.inbound
and strings.ilike(headers.mailer, '*phpmailer*')
and any(attachments, .file_name in~ ('image.png', 'name.png', 'use.png'))

Field Validations

Loading…

Comments (0)

Loading comments...