Sublime Security high experimental mql

Service Abuse: ExactTarget with suspicious sender indicators

Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.

View Source

Detection Logic

type.inbound
and any(headers.domains, .root_domain == 'exacttarget.com')
and (
  (
    length(sender.email.email) >= 50
    and sender.email.domain.root_domain == "salesforce.com"
  )
  or sender.email.domain.root_domain == "awsapps.com"
  or strings.icontains(sender.email.domain.domain, '?utf-8')
  or regex.icontains(sender.display_name,
                     '.*\
| .*(Manager
| Careers
| Recruitment
| Specialist
| Global)'
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...