Medium Severity
Brand impersonation: ADP
Description
Impersonation of the payroll provider ADP. Most commonly seen around US tax season (Q1)
Sublime Security
Created Aug 17th, 2023 • Last updated Jan 9th, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and sender.display_name in~ ('RS-Plan-Admin@adp.com', 'ADP', 'SecurityServices_NoReply@adp.com')
and sender.email.domain.root_domain not in~ ('adp.com', 'adpsurveys.com','adp.com.br')
and sender.email.email not in $recipient_emails
Playground
Test against your own EMLs or sample data.