detection.wiki

Detection rules › Sublime MQL

Disposable sender email (unsolicited)

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Sender is using a disposable email service and no one in our organization has ever sent them an email.

Event coverage

Message attribute
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain in $disposable_email_providers
and sender.email.email not in $recipient_emails

Detection logic

Scope: inbound message.

Sender is using a disposable email service and no one in our organization has ever sent them an email.

  1. inbound message
  2. sender.email.domain.root_domain in $disposable_email_providers
  3. sender.email.email not in $recipient_emails

Inspects: sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $disposable_email_providers, $recipient_emails.