Medium Severity

Impersonation: IT Department mailbox storage alert

Description

Detects inbound messages impersonating an internal IT Department by presenting a fake mailbox storage alert.

References

No references.

Sublime Security
Created Jul 7th, 2026 • Last updated Jul 7th, 2026
Source
type.inbound
and strings.contains(body.current_thread.text, 'MAILBOX STORAGE ALERT')
and all([
          'Clean Inbox',
          'Storage Guide',
          'Empty Deleted Items',
          'Clean Mailbox Now',
          'Contact IT Support'
        ],
        . in map(html.xpath(body.html, '//a').nodes, .display_text)
)
and any(body.previous_threads,
        strings.contains(.text, 'IT Department')
        and strings.contains(.text, 'call ext. 5555')
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started