Medium Severity
Attachment: Dropbox image lure with no Dropbox domains in links
Labels
Description
Detects Dropbox phishing emails with no Dropbox links with image attachments from first time sender.
References
No references.
Sublime Security
Created Aug 17th, 2023 • Last updated Dec 7th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and length(filter(attachments, .file_type not in $file_types_images)) == 0
and any(body.links,
not strings.ilike(.href_url.domain.root_domain, "dropbox.*")
)
and any(attachments,
.file_type in $file_types_images
and any(file.explode(.),
strings.ilike(.scan.ocr.raw, "*dropbox*")
and strings.ilike(.scan.ocr.raw, "*review*", "*sign*")
)
)
and (
length(headers.references) == 0
or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
Playground
Test against your own EMLs or sample data.