Sublime Security medium experimental mql
Service abuse: Google Calendar notification with callback scam language
Detects messages sent from Google's legitimate calendar notification service that contain callback scam language, indicating potential abuse of the calendar sharing feature to distribute fraudulent content.
Detection Logic
type.inbound
and sender.email.email == 'calendar-notification@google.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)Field Validations
Loading…
Comments (0)
Loading comments...