Sublime Security medium experimental mql

Service abuse: Free provider with SendGrid routing

Message From header includes a free email provider domain but is routed through SendGrid infrastructure, indicating potential service abuse for delivery evasion.

View Source

Detection Logic

type.inbound
and sender.email.domain.domain in $free_email_providers
and any(headers.domains, .root_domain == "sendgrid.net")
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign"
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Bounce Back and Delivery Failure Notifications"
)

Field Validations

Loading…

Comments (0)

Loading comments...