Sublime Security high experimental mql

Service abuse: Google account notification with links to free file host

Detects messages impersonating Google Accounts that contain links redirecting to known file hosting services

Detection Logic

type.inbound
and sender.email.email == "no-reply@accounts.google.com"
and any(body.links, .href_url.domain.domain in $free_file_hosts)

Loading…

Loading comments...