Sublime Security medium experimental mql

Service abuse: Wufoo credential theft

Detects malicious messages sent from Wufoo's sending address (no-reply@wufoo.com) that are abusing the platform to deliver credential theft content. This rule identifies messages that lack Wufoo's standard display name and structural HTML elements found in legitimate Wufoo emails, while containing links and content classified as credential theft by NLU analysis.

View Source

Detection Logic

type.inbound
and sender.email.email == 'no-reply@wufoo.com'
and not strings.icontains(sender.display_name, 'Wufoo')
// table found in legit wufoo emails
and not length(html.xpath(body.html, "//table[@class='readonly']").nodes) == 1
and 0 < length(body.links)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)

Field Validations

Loading…

Comments (0)

Loading comments...