Sublime Security low experimental mql

Suspicious display name: Gmail sender with engaging language

Detects Gmail senders using display names with suspicious language patterns commonly associated with social engineering tactics, including urgency indicators, contact requests, and verification prompts.

View Source

Detection Logic

type.inbound
and 2 of (
  strings.icontains(sender.display_name, "kindly"),
  strings.icontains(sender.display_name, 'phone'),
  strings.icontains(sender.display_name, 'cell'),
  strings.icontains(sender.display_name, 'expedite'),
  strings.icontains(sender.display_name, 'urgent'),
  strings.icontains(sender.display_name, 'contact'),
  strings.icontains(sender.display_name, 'review'),
  strings.icontains(sender.display_name, 'confirm'),
  strings.icontains(sender.display_name, 'asap'),
  strings.icontains(sender.display_name, 'follow up'),
  strings.icontains(sender.display_name, 'nicely'),
  strings.icontains(sender.display_name, 'btc'),
  strings.icontains(sender.display_name, 'reply'),
  strings.icontains(sender.display_name, 'respond'),
  strings.icontains(sender.display_name, 'verify'),
  strings.icontains(sender.display_name, 'convenience'),
  strings.icontains(sender.display_name, 'response'),
  strings.icontains(sender.display_name, 'number'),
  strings.icontains(sender.display_name, 'mobile'),
  strings.icontains(sender.display_name, 'text'),
  strings.icontains(sender.display_name, 'request'),
  strings.icontains(sender.display_name, 'required'),
  strings.icontains(sender.display_name, 'important'),
  strings.icontains(sender.display_name, 'need'),
  strings.icontains(sender.display_name, 'quick'),
  strings.icontains(sender.display_name, 'sensitive'),
  strings.icontains(sender.display_name, 'reach'),
  strings.icontains(sender.display_name, 'action'),
  (
    strings.icontains(sender.display_name, 'monday')
    or strings.icontains(sender.display_name, 'tuesday')
    or strings.icontains(sender.display_name, 'wednesday')
    or strings.icontains(sender.display_name, 'thursday')
    or strings.icontains(sender.display_name, 'friday')
    or strings.icontains(sender.display_name, 'saturday')
    or strings.icontains(sender.display_name, 'sunday')
  ),
  (
    strings.icontains(sender.display_name, 'january')
    or strings.icontains(sender.display_name, 'february')
    or strings.icontains(sender.display_name, 'march')
    or strings.icontains(sender.display_name, 'april')
    or strings.icontains(sender.display_name, 'may')
    or strings.icontains(sender.display_name, 'june')
    or strings.icontains(sender.display_name, 'july')
    or strings.icontains(sender.display_name, 'august')
    or strings.icontains(sender.display_name, 'september')
    or strings.icontains(sender.display_name, 'october')
    or strings.icontains(sender.display_name, 'november')
    or strings.icontains(sender.display_name, 'december')
  )
)
and sender.email.domain.domain == 'gmail.com'
and length(attachments) == 0
and length(body.current_thread.links) == 0

Field Validations

Loading…

Comments (0)

Loading comments...