• Sublime Core Feed
Medium Severity

Service abuse: SendThisFile with credential theft and financial language

Description

Detects messages from sendthisfile.com containing credential theft language combined with financial communications topics.

References

No references.

Sublime Security
Created Oct 27th, 2025 • Last updated Oct 27th, 2025
Source
type.inbound
and sender.email.domain.root_domain == "sendthisfile.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Financial Communications" and .confidence != "low"
)
// not a reply or forward
and (headers.in_reply_to is null or length(headers.references) == 0)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started