Medium Severity

Service abuse: IBM IAM account notification with callback scam indicators

Description

Detects inbound messages abusing IBM's IAM account notification address that contain callback scam intent patterns identified through natural language analysis.

References

No references.

Sublime Security
Created Jun 16th, 2026 • Last updated Jun 16th, 2026
Source
type.inbound
and sender.email.email == "ibmacct@iam.ibm.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started