Sublime Security medium experimental mql

Spam: SMTP & Proxy Communications in Email Body

An email containing SMTP and Proxy (socks5) command and control information within the body of the message.

View Source

Detection Logic

type.inbound
and length(attachments) == 0
and 1 < length(body.links) < 5
and regex.icontains(body.current_thread.text,
                    '(?:\:socks5:
| ::127.0.0.1:1080
| :0:127.0.0.1:1080)'
)

Field Validations

Loading…

Comments (0)

Loading comments...