Sublime Security medium experimental mql

Service abuse: IBM IAM account notification with callback scam indicators

Detects inbound messages abusing IBM's IAM account notification address that contain callback scam intent patterns identified through natural language analysis.

View Source

Detection Logic

type.inbound
and sender.email.email == "ibmacct@iam.ibm.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
)

Field Validations

Loading…

Comments (0)

Loading comments...