• Sublime Core Feed
Medium Severity

Link: Direct link to Zoom Docs from Non-Zoom Sender

Labels

Credential Phishing
Social engineering
Impersonation: Brand
Header analysis
URL analysis
Sender analysis

Description

Message includes a single link to Zoom Docs, with no other links to zoom and originates from a sender outside the Zoom organization

References

No references.

Sublime Security
Created May 22nd, 2025 • Last updated May 22nd, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
// contains a link to zoom docs
and any(body.links, .href_url.domain.domain == "docs.zoom.us")
// is the only link to zoom
and length(filter(body.links, .href_url.domain.root_domain == "zoom.us")) == 1
// not from zoom.us
and not (
  sender.email.domain.root_domain == "zoom.us"
  and headers.auth_summary.dmarc.pass
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started