Sublime Security medium experimental mql
Service abuse: MongoDB Atlas callback scam
Detects inbound messages from MongoDB Atlas alert addresses that contain callback scam content identified through natural language analysis with medium or high confidence.
Detection Logic
type.inbound
and sender.email.email == "mongodb-atlas-alerts@mongodb.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)Field Validations
Loading…
Comments (0)
Loading comments...