Medium Severity
Link: Direct link to Zoom Docs from Non-Zoom Sender
Description
Message includes a single link to Zoom Docs, with no other links to zoom and originates from a sender outside the Zoom organization
References
No references.
Sublime Security
Created May 22nd, 2025 • Last updated May 22nd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
// contains a link to zoom docs
and any(body.links, .href_url.domain.domain == "docs.zoom.us")
// is the only link to zoom
and length(filter(body.links, .href_url.domain.root_domain == "zoom.us")) == 1
// not from zoom.us
and not (
sender.email.domain.root_domain == "zoom.us"
and headers.auth_summary.dmarc.pass
)
Playground
Test against your own EMLs or sample data.