Sublime-Message-headers Event ID 7000011

Sublime MQL (90)

• AnonymousFox indicators severity high
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Calendar invite with suspicious link leading to an open redirect severity high
• Attachment: Callback phishing solicitation via text-based file severity medium
• Attachment: DocuSign impersonation via PDF linking to new domain severity medium
• Attachment: EML file contains HTML attachment with login portal indicators severity high
• Attachment: Fake secure message and suspicious indicators severity medium
• Attachment: Microsoft 365 credential phishing severity high
• Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
• Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
• BEC with unusual reply-to or return-path mismatch severity high
• Benefits enrollment impersonation severity high
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Amazon severity low
• Brand impersonation: Booking.com severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Cloud services with credential theft intent severity medium
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
• Brand impersonation: Github severity high
• Brand Impersonation: Google (QR Code) severity high
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Internal Revenue Service severity high
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft fake sign-in alert severity medium
• Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Morgan Stanley severity medium
• Brand Impersonation: ShareFile severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
• Brand Impersonation: Stripe severity high
• Brand impersonation: TikTok severity medium
• ClickFunnels link infrastructure abuse severity high
• Constant Contact link infrastructure abuse severity high
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Hyper-linked image leading to free file host severity medium
• Credential phishing: Onedrive impersonation severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Employee impersonation: Payroll fraud severity high
• Encrypted Microsoft Office files from untrusted sender severity medium
• Extortion / sextortion (untrusted sender) severity low
• Extortion / sextortion in attachment from untrusted sender severity low
• Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Free email provider sender with mismatched provider reply-to severity medium
• Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
• Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
• HTML smuggling containing recipient email address severity medium
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Inbound message from popular service via newly observed distribution list severity medium
• Link: Credential phishing traversing Russian infrastructure severity high
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: Free file hosting with undisclosed recipients severity medium
• Link: Free subdomain host with undisclosed recipients severity medium
• Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
• Link: Uncommon SharePoint document type with sender's display name severity medium
• Mass campaign: Cross Site Scripting (XSS) attempt severity medium
• Message traversed multiple onmicrosoft.com tenants severity medium
• Microsoft infrastructure abuse with suspicious patterns severity high
• Open redirect: predictiveresponse.net severity medium
• Salesforce infrastructure abuse severity medium
• Service abuse: HelloSign from an unsolicited sender address severity low
• Service Abuse: HelloSign share with suspicious sender or document name severity medium
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Service abuse: Trello board invitation with VIP impersonation severity medium
• SharePoint OTP for filename matching org name severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: BlackBaud infrastructure abuse severity medium
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Fake photo share severity low
• Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
• Spam: Single recipient duplicated in cc severity medium
• SPF temp error severity medium
• Spoofable internal domain with suspicious signals severity medium
• Suspected cross-site scripting (XSS) found in subject severity medium
• Suspicious mailer received from Gmail servers severity low
• Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
• VIP Impersonation via Google Group relay with suspicious indicators severity high
• Xero infrastructure abuse severity medium