Sublime Security medium experimental mql

Sendgrid onmicrosoft.com domain phishing

The message originates from an onmicrosoft.com email address being sent via Sendgrid.

View Source

Detection Logic

type.inbound
and headers.return_path.domain.domain == "sendgrid.net"
and sender.email.domain.root_domain == "onmicrosoft.com"
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)

Field Validations

Loading…

Comments (0)

Loading comments...