Sublime Security low experimental mql
Suspicious display name: Gmail sender with engaging language
Detects Gmail senders using display names with suspicious language patterns commonly associated with social engineering tactics, including urgency indicators, contact requests, and verification prompts.
Detection Logic
type.inbound
and 2 of (
strings.icontains(sender.display_name, "kindly"),
strings.icontains(sender.display_name, 'phone'),
strings.icontains(sender.display_name, 'cell'),
strings.icontains(sender.display_name, 'expedite'),
strings.icontains(sender.display_name, 'urgent'),
strings.icontains(sender.display_name, 'contact'),
strings.icontains(sender.display_name, 'review'),
strings.icontains(sender.display_name, 'confirm'),
strings.icontains(sender.display_name, 'asap'),
strings.icontains(sender.display_name, 'follow up'),
strings.icontains(sender.display_name, 'nicely'),
strings.icontains(sender.display_name, 'btc'),
strings.icontains(sender.display_name, 'reply'),
strings.icontains(sender.display_name, 'respond'),
strings.icontains(sender.display_name, 'verify'),
strings.icontains(sender.display_name, 'convenience'),
strings.icontains(sender.display_name, 'response'),
strings.icontains(sender.display_name, 'number'),
strings.icontains(sender.display_name, 'mobile'),
strings.icontains(sender.display_name, 'text'),
strings.icontains(sender.display_name, 'request'),
strings.icontains(sender.display_name, 'required'),
strings.icontains(sender.display_name, 'important'),
strings.icontains(sender.display_name, 'need'),
strings.icontains(sender.display_name, 'quick'),
strings.icontains(sender.display_name, 'sensitive'),
strings.icontains(sender.display_name, 'reach'),
strings.icontains(sender.display_name, 'action'),
(
strings.icontains(sender.display_name, 'monday')
or strings.icontains(sender.display_name, 'tuesday')
or strings.icontains(sender.display_name, 'wednesday')
or strings.icontains(sender.display_name, 'thursday')
or strings.icontains(sender.display_name, 'friday')
or strings.icontains(sender.display_name, 'saturday')
or strings.icontains(sender.display_name, 'sunday')
),
(
strings.icontains(sender.display_name, 'january')
or strings.icontains(sender.display_name, 'february')
or strings.icontains(sender.display_name, 'march')
or strings.icontains(sender.display_name, 'april')
or strings.icontains(sender.display_name, 'may')
or strings.icontains(sender.display_name, 'june')
or strings.icontains(sender.display_name, 'july')
or strings.icontains(sender.display_name, 'august')
or strings.icontains(sender.display_name, 'september')
or strings.icontains(sender.display_name, 'october')
or strings.icontains(sender.display_name, 'november')
or strings.icontains(sender.display_name, 'december')
)
)
and sender.email.domain.domain == 'gmail.com'
and length(attachments) == 0
and length(body.current_thread.links) == 0 Field Validations
Loading…
Comments (0)
Loading comments...