Detection rules › Sublime MQL
Service abuse: Zoom with newly registered reply-to domain
Detects messages from legitimate Zoom infrastructure (no-reply@zoom.us) that contain a reply-to address with a domain registered within the last 45 days, indicating potential abuse of Zoom's service for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| headers.reply_to (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
// Legitimate zoom sending infrastructure
and sender.email.email == "no-reply@zoom.us"
// newly registered reply-to domain
and network.whois(headers.reply_to[0].email.domain).days_old < 45
Detection logic
Scope: inbound message.
Detects messages from legitimate Zoom infrastructure (no-reply@zoom.us) that contain a reply-to address with a domain registered within the last 45 days, indicating potential abuse of Zoom's service for malicious purposes.
- inbound message
- sender.email.email is 'no-reply@zoom.us'
- network.whois(headers.reply_to[0].email.domain).days_old < 45
Inspects: headers.reply_to[0].email.domain, sender.email.email, type.inbound. Sensors: network.whois.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | no-reply@zoom.us |