Sublime Security low experimental mql

Sender: Local part built from recipient domain and mailbox

Flags inbound messages where the sender's local part is constructed by combining the recipient's domain name and mailbox name (e.g., domain_mailbox). This pattern is commonly used to make the sender address appear related to or originating from the recipient's own organization, helping the message blend in and evade scrutiny.

View Source

Detection Logic

type.inbound
and sender.email.local_part == strings.concat(recipients.to[0].email.domain.sld,
                                              '_',
                                              recipients.to[0].email.local_part
)
and sender.email.domain.root_domain != recipients.to[0].email.domain.root_domain

Field Validations

Loading…

Comments (0)

Loading comments...