Sublime Security medium experimental mql
Service abuse: Microsoft Power Automate callback scam impersonation
Detects callback scam attempts using the legitimate Microsoft Power Automate service email address with high-confidence callback scam language in the message body.
Detection Logic
type.inbound
and sender.email.email == 'flow-noreply@microsoft.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)Field Validations
Loading…
Comments (0)
Loading comments...