Detection rules › By catalog entry

Sublime-Message-subject

Catalog entry	Rules
subject	369

subject

369 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (369)

Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Calendar file with invisible Unicode characters severity high
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: Callback phishing solicitation via text-based file severity medium
Attachment: Cold outreach with invitation subject and not attachment severity high
Attachment: Credit card application with WhatsApp contact severity medium
Attachment: EML file contains HTML attachment with login portal indicators severity high
Attachment: EML file with HTML attachment (unsolicited) severity medium
Attachment: EML with link to credential phishing page severity high
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: Encrypted zip file with payment-related lure severity medium
Attachment: Fake attachment image lure severity medium
Attachment: Fake research internship offer severity medium
Attachment: Fake voicemail via PDF severity medium
Attachment: ICS file with credential theft indicators severity medium
Attachment: ICS invite meeting lure severity medium
Attachment: Legal themed message or PDF with suspicious indicators severity medium
Attachment: Microsoft 365 credential phishing severity high
Attachment: PDF bid/proposal lure with credential theft indicators severity medium
Attachment: PDF proposal with credential theft indicators severity high
Attachment: QR code link with base64-encoded recipient address severity high
Attachment: RFP/RFQ impersonating government entities severity high
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
Attachment: Suspicious employee policy update document lure severity medium
Attachment: USDA bid invitation impersonation severity medium
BEC/Fraud: Fake investment outreach from suspicious TLD severity medium
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Unsolicited business acquisition offer severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
BEC: Employee impersonation with subject manipulation severity high
BEC: Tax document request severity medium
Benefits enrollment impersonation severity high
beta.DLP: Australia ABN severity high
beta.DLP: Australia Bank Account severity high
beta.DLP: Australia Driver's License severity high
beta.DLP: Australia Medicare severity high
beta.DLP: Australia Passport Number severity high
beta.DLP: Australia Tax File Number severity high
beta.DLP: Austria VAT severity high
beta.DLP: AWS Access Key severity high
beta.DLP: Basic Auth Header severity high
beta.DLP: Belgium VAT severity high
beta.DLP: Canada Bank Account severity high
beta.DLP: Canada Driver's License severity high
beta.DLP: Canada Health Service Number severity high
beta.DLP: Canada Passport Number severity high
beta.DLP: Canada PHIN severity high
beta.DLP: Canadian Social Insurance Number (SIN) severity high
beta.DLP: China Resident ID severity high
beta.DLP: Crypto Wallet Address severity high
beta.DLP: DEA Number severity high
beta.DLP: Finland European Health Insurance severity high
beta.DLP: France Bank Account severity high
beta.DLP: France Driver's License severity high
beta.DLP: France National ID (CNI) severity high
beta.DLP: France Passport Number severity high
beta.DLP: France Social Security Number (INSEE) severity high
beta.DLP: France VAT severity high
beta.DLP: Germany Identity Card (Personalausweis) severity high
beta.DLP: Germany Passport Number severity high
beta.DLP: Germany Tax ID (Steueridentifikationsnummer) severity high
beta.DLP: Germany VAT severity high
beta.DLP: GitHub Token severity high
beta.DLP: Google / GCP API Key severity high
beta.DLP: Hungary TAJ severity high
beta.DLP: Hungary VAT severity high
beta.DLP: IBAN Code severity high
beta.DLP: ICD-10 Code severity high
beta.DLP: ICD-9 Code severity high
beta.DLP: Japan Driver's License severity high
beta.DLP: Japan MyNumber ID severity high
beta.DLP: Japan Passport Number severity high
beta.DLP: JSON Web Token (JWT) severity high
beta.DLP: Luxembourg Non-Natural ID severity high
beta.DLP: MAC Address severity high
beta.DLP: National Provider Identifier (NPI) severity high
beta.DLP: Netherlands BSN / Tax ID severity high
beta.DLP: Netherlands VAT severity high
beta.DLP: New Zealand Bank Account severity high
beta.DLP: New Zealand MOH severity high
beta.DLP: NHS Number severity high
beta.DLP: OAuth Client Secret severity high
beta.DLP: PCI US Credit Card Number (Any Network) severity high
beta.DLP: Poland REGON severity high
beta.DLP: Private Key severity high
beta.DLP: Singapore NRIC severity high
beta.DLP: Singapore UEN severity high
beta.DLP: Slack Access Token severity high
beta.DLP: South Korea Resident Registration Number severity high
beta.DLP: Spain Bank Account severity high
beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID severity high
beta.DLP: Spain Passport Number severity high
beta.DLP: SSL/TLS Certificate severity high
beta.DLP: Sweden Personnummer / Tax ID severity high
beta.DLP: SWIFT/BIC Code severity high
beta.DLP: UK Driver's License severity high
beta.DLP: UK National Insurance Number severity high
beta.DLP: UK Passport severity high
beta.DLP: UK UTR (Tax) severity high
beta.DLP: US ABA Routing Number severity high
beta.DLP: US Bank Account Number severity medium
beta.DLP: US Driver's License severity high
beta.DLP: US Individual Taxpayer Identification Number (ITIN) severity high
beta.DLP: US Medicare Beneficiary ID severity high
beta.DLP: US Passport Number severity high
beta.DLP: US Social Security Number (SSN) severity high
beta.DLP: Vehicle VIN severity high
Body: Embedded email headers indicative of thread hijacking/abuse severity medium
Body: Fake secure email portal with HTML obfuscation severity high
Body: PayApp transaction reference pattern severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: Amazon severity low
Brand impersonation: Aramco severity medium
Brand impersonation: Automobile assistance associations severity high
Brand impersonation: Binance severity medium
Brand impersonation: Box file sharing service severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Chase Bank severity high
Brand impersonation: DHL severity low
Brand impersonation: Discord notification severity medium
Brand impersonation: DocuSign severity high
Brand impersonation: Enbridge severity medium
Brand impersonation: Evite severity medium
Brand impersonation: Fake Fax severity medium
Brand impersonation: Figma with malicious document access overlay severity high
Brand impersonation: File sharing notification with template artifacts severity low
Brand Impersonation: Gemini Trust Company severity medium
Brand impersonation: Github severity high
Brand impersonation: GitHub with callback scam indicators severity medium
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Greenvelope severity medium
Brand impersonation: Greetings Island severity high
Brand impersonation: Interac severity medium
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: Mailgun severity medium
Brand impersonation: Marriott with gift language severity medium
Brand impersonation: McAfee severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft Teams invitation severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: MyChart severity medium
Brand impersonation: Navan severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Okta severity medium
Brand Impersonation: OpenAI with ChatGPT Ads lure severity high
Brand impersonation: OpenAI with payment issues severity high
Brand impersonation: Paperless Post severity high
Brand impersonation: PNC severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: QuickBooks dispute notification severity high
Brand impersonation: Robinhood severity medium
Brand impersonation: SendGrid severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand impersonation: Social Security Administration severity medium
Brand impersonation: SoFi severity medium
Brand impersonation: Toronto-Dominion Bank severity medium
Brand impersonation: UK government Home Office severity high
Brand impersonation: ukr[.]net severity medium
Brand impersonation: UPS severity low
Brand impersonation: USPS severity high
Brand impersonation: Wells Fargo severity high
Brand impersonation: WeTransfer severity high
Brand impersonation: Zoom severity medium
Brand impersonation: Zoom via lookalike domain severity high
Brand impersonation: Zoom with deceptive link display severity medium
Business Email Compromise (BEC) attempt from untrusted sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
Business Email Compromise (BEC) with request for mobile number severity medium
Callback phishing via DocuSign comment severity high
Callback phishing via Google Meet severity medium
Callback phishing via Intuit service abuse severity medium
Callback phishing via Microsoft comment severity medium
Callback phishing via Yammer comment severity medium
Callback phishing via Zelle Service Abuse severity medium
Callback phishing via Zoho service abuse severity medium
Callback Phishing via Zoom comment severity medium
Callback scam: Impersonation via TimeTrade infrastructure severity medium
ClickFunnels link infrastructure abuse severity high
Cloud storage impersonation with credential theft indicators severity medium
Commonly abused sender TLD with engaging language severity medium
Compensation review with QR code in attached EML severity high
Constant Contact link infrastructure abuse severity high
COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing link (unknown sender) severity high
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: Blue button styled link with file-sharing template artifacts severity low
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake card notification with tracking lure severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Generic document sharing severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Re-Authentication lure severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential Phishing: Suspicious language, link, recipients and other indicators severity medium
Credential phishing: Suspicious subject with urgent financial request and link severity medium
Credential phishing: Tax form impersonation with payment request severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display Name Emoji with Financial Symbols severity low
DLP - Clear-Text Credentials Outbound severity critical
DLP: Slack Token severity high
DocuSign impersonation via CloudHQ links severity medium
DocuSign impersonation via spoofed Intuit sender severity high
EML attachment with credential theft language (unknown sender) severity high
Employee impersonation with urgent request (untrusted sender) severity medium
Employee impersonation: Payroll fraud severity high
Evasion: Variation selectors in subject line severity medium
Extortion / sextortion (untrusted sender) severity low
Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender severity high
Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake request for tax preparation severity high
Fake scan-to-email message severity medium
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoom meeting invite with suspicious link severity medium
File sharing link with a suspicious subject severity medium
Google Notification alert link from non-Google sender severity medium
Headers: Fake in-reply-to with wildcard sender and missing thread context severity high
Headers: System account impersonation with empty sender address severity medium
Impersonation: Australian Federal Police with criminal case language severity high
Impersonation: Chrome Web Store policy severity low
Impersonation: Employee name in subject with suspicious sender severity medium
Impersonation: Employee using fabricated identity in initial contact severity high
Impersonation: HR administrative center PDF password lure severity medium
Impersonation: Internal corporate services severity high
Impersonation: Legal firm with copyright infringement notice severity medium
Impersonation: SharePoint reply header anomaly severity medium
Investor solicitation with organization targeting severity medium
Link: Apple TestFlight from suspicious sender severity medium
Link: Base64 encoded recipient address in URL fragment with subject hash severity low
Link: BEC with newly registered domains and financial keywords severity medium
Link: Display text matches subject line severity medium
Link: Executable file download with suspicious message content severity high
Link: File sharing pretext with suspicious body and link severity medium
Link: Fraudulent state business filing notice severity medium
Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
Link: HR impersonation with suspicious domain indicators and credential theft severity high
Link: Invalid reply-to with recipient details in subject, body, and encoded link severity medium
Link: Job recruitment lure from unsolicited sender with suspicious hosting severity medium
Link: Microsoft impersonation using hosted png with suspicious link severity medium
Link: Multistage landing - Abused Adobe frame.io severity high
Link: Multistage landing - Abused Google Drive severity high
Link: Non-standard port 8443 in display URL severity medium
Link: PDF and financial display text to free file host severity high
Link: Personalized URL with recipient address on commonly abused web service severity medium
Link: Secure SharePoint file share from new or unusual sender severity low
Link: Self-sender with sender org in subject and credential theft indicator severity high
Link: Self-sent message with quarterly document review request severity critical
Link: Self-sent PDF lure with subject correlation severity medium
Link: SharePoint filename matches org name severity medium
Link: SharePoint files shared from GoDaddy federated tenants severity low
Link: Shortened URL with fragment matching subject severity medium
Link: Suspicious HTML structure with subject mirrored in body and single link severity medium
Link: Suspicious SharePoint document name severity low
Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
Link: Uncommon SharePoint document type with sender's display name severity medium
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
Mismatched links: Free file share with urgent language severity medium
PayPal invoice abuse severity medium
QR Code with suspicious indicators severity high
Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
Reconnaissance: Email address harvesting attempt severity medium
Reconnaissance: Empty message from uncommon sender severity low
Reconnaissance: Empty subject with mismatched reply-to from new sender severity medium
Reconnaissance: Fake real estate inquiry with empty body severity medium
Reconnaissance: Hotel booking reply-to redirect severity medium
Reconnaissance: Large unknown recipient list severity low
Reconnaissance: Short generic greeting message severity medium
Request for Quote or Purchase (RFQ|RFP) with HTML smuggling attachment severity high
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Salesforce infrastructure abuse severity medium
Scam soliciting employer review/rating severity low
Self-impersonation: Sender matches recipient with bolded name and suspicious link severity medium
Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
Sendgrid voicemail phish severity high
Service abuse: Adobe Sign notification from an unsolicited reply-to address severity medium
Service abuse: Amazon invitation with suspected callback phishing severity medium
Service abuse: Arketa notification callback scam severity medium
Service abuse: AWS SNS callback scam impersonation severity medium
Service Abuse: Box file sharing with credential phishing intent severity medium
Service abuse: Callback phishing via Microsoft Teams invite severity high
Service abuse: Cisco secure email service with financial request severity high
Service abuse: Demio notifications with suspicious content patterns severity medium
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service abuse: DocuSign share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share with suspicious sender or document name severity medium
Service abuse: Facebook business with action required subject severity medium
Service abuse: Facebook mail notification callback scam severity medium
Service abuse: File sharing impersonation with external SharePoint links severity medium
Service Abuse: GoDaddy infrastructure severity medium
Service abuse: Google classroom solicitation severity medium
Service abuse: Google Firebase sender address with suspicious content severity low
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: Kagoya.net-hosted domains sending English business lures severity low
Service abuse: Microsoft Power Apps callback scam severity medium
Service abuse: Microsoft with suspicious indicators in subject severity medium
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: Outlook Groups with Google Sites link and evasion tag severity medium
Service abuse: PayPal manager account creation with callback scam indicators severity medium
Service abuse: QuickBooks notification from new domain severity medium
Service abuse: QuickBooks notification with suspicious comments severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Service abuse: Task management message sent via SendGrid severity medium
Service abuse: Vimeo with external plain-text links in message severity high
Service abuse: Zoom Clips with suspicious reply-to address or links severity low
Sharepoint file share with suspicious recipients pattern severity medium
Spam: Attendee list solicitation severity low
Spam: BlackBaud infrastructure abuse severity medium
Spam: Commonly observed formatting of unauthorized free giveaways severity low
Spam: Cryptocurrency airdrop/giveaway severity low
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake photo share severity low
Spam: Ghostwriting services scam with manipulative language severity medium
Spam: Large financial amount mention from newly registered sender domain severity medium
Spam: Mastercard promotional content with image-based body severity low
Spam: New job cold outreach from unsolicited sender severity low
Spam: New link domain (<=10d) and emojis severity medium
Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
Spam: Sexually explicit content with emoji in subject from freemail provider severity low
Spam: Sexually explicit Google Drive share severity low
Spam: Sexually explicit Google group invitation severity low
Spam: Sexually explicit Looker Studio report severity low
Spam: Single recipient duplicated in cc severity medium
Spam: Suspicious toll-free phone number severity low
Spam: URL shortener with short body content and emojis severity low
Spam: Website errors solicitation severity low
Subject and sender display name contains matching long alphanumeric string severity low
Subject: Suspicious bracketed reference severity high
Suspected cross-site scripting (XSS) found in subject severity medium
Suspected WordPress abuse with cross-site scripting (XSS) indicators severity high
Suspicious attachment with unscannable Cloudflare link severity medium
Suspicious DocuSign share from new domain severity high
Suspicious invoice reference with missing or image-only attachments severity high
Suspicious message with unscannable Cloudflare link severity medium
Suspicious message with unscannable Vercel link severity medium
Suspicious request for financial information severity high
Suspicious SharePoint file sharing severity medium
Suspicious subject with long procedurally generated text blob severity medium
Tax Form: W-8BEN solicitation severity medium
Vendor impersonation: Thread hijacking with typosquat domain severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with charitable donation fraud severity high
VIP impersonation with w2 request with reply-to mismatch severity high
VIP impersonation: VIP name within a delimited subject with fake previous threads severity high
Xero infrastructure abuse severity medium

Back to all Sublime-Message-subject catalog entries