Sublime Security medium experimental mql

Service abuse: Notion free-tier account impersonating VIP

Detects messages sent from Notion's legitimate notification address (notify@mail.notion.so), but where the sender's display name matches an internal VIP, and the embedded links resolve to a Notion workspace associated with a free-tier subscription. This pattern indicates abuse of Notion's free tier to craft convincing internal impersonation lures.

View Source

Detection Logic

type.inbound
and sender.email.email == 'notify@mail.notion.so'
// from VIP
and any($org_vips, strings.icontains(sender.display_name, .display_name))
and any(body.current_thread.links,
        any(ml.link_analysis(.).additional_responses,
            .json['statsigUser']['custom']['spaceSubscriptionTier'] == 'free'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...