Service abuse: Postman reply-to mismatch with credential theft intent

calendar Jul 29, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from Postman.io where the reply-to address belongs to a different domain than the sender, combined with high or medium confidence credential theft intent detected in the message body. This technique leverages a legitimate service to deliver messages while redirecting replies to an attacker-controlled address.

Sublime rule (View on GitHub)

 1name: "Service abuse: Postman reply-to mismatch with credential theft intent"
 2description: "Detects inbound messages sent from Postman.io where the reply-to address belongs to a different domain than the sender, combined with high or medium confidence credential theft intent detected in the message body. This technique leverages a legitimate service to deliver messages while redirecting replies to an attacker-controlled address."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "postman.io"
 8  and any(headers.reply_to,
 9          .email.domain.root_domain != sender.email.domain.root_domain
10  )
11  and any(ml.nlu_classifier(body.current_thread.text).intents,
12          .name == "cred_theft" and .confidence != "low"
13  )  
14attack_types:
15  - "Credential Phishing"
16tactics_and_techniques:
17  - "Social engineering"
18  - "Out of band pivot"
19detection_methods:
20  - "Sender analysis"
21  - "Header analysis"
22  - "Natural Language Understanding"
23id: "d7177124-8e9f-5916-a3c5-45c22b34ce4f"
to-top