Detection rules › Sublime MQL

Sublime MQL rules: anthropic

Rule	Severity
Anthropic Magic String in HTML	`low`

Anthropic Magic String in HTML

Severity: low
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware
Tactics and techniques	Exploit

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.html
body.plain
type

Rule body

type.inbound
and length(attachments) <= 3
and (
  strings.icontains(body.html.raw, 'ANTHROPIC_MAGIC_STRING_')
  or strings.icontains(body.plain.raw, 'ANTHROPIC_MAGIC_STRING_')
  or strings.icontains(body.html.display_text, 'ANTHROPIC_MAGIC_STRING_')
  or any(attachments,
         any(file.explode(.),
             strings.icontains(.scan.ocr.raw, "ANTHROPIC_MAGIC_STRING_")
             or strings.icontains(.scan.strings.raw, "ANTHROPIC_MAGIC_STRING_")
         )
  )
)

Detection logic

Scope: inbound message.

Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.

inbound message
length(attachments) ≤ 3
any of:
- body.html.raw contains 'ANTHROPIC_MAGIC_STRING_'
- body.plain.raw contains 'ANTHROPIC_MAGIC_STRING_'
- body.html.display_text contains 'ANTHROPIC_MAGIC_STRING_'
- any of attachments where:
  - any of file.explode(.) where any holds:
    
    .scan.ocr.raw contains 'ANTHROPIC_MAGIC_STRING_'
    .scan.strings.raw contains 'ANTHROPIC_MAGIC_STRING_'

Inspects: body.html.display_text, body.html.raw, body.plain.raw, type.inbound. Sensors: file.explode, strings.icontains.

Indicators matched (1)

Field	Match	Value
`strings.icontains`	substring	`ANTHROPIC_MAGIC_STRING_`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      any(file.explode(attachments))
        or
          file.explode(attachments[])[].scan.ocr.raw contains "ANTHROPIC_MAGIC_STRING_"
          file.explode(attachments[])[].scan.strings.raw contains "ANTHROPIC_MAGIC_STRING_"
    body.html.display_text contains "ANTHROPIC_MAGIC_STRING_"
    body.html.raw contains "ANTHROPIC_MAGIC_STRING_"
    body.plain.raw contains "ANTHROPIC_MAGIC_STRING_"
  attachments length_compare "3"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.html.display_text`	contains	`ANTHROPIC_MAGIC_STRING_`	`field:"body.html.display_text" kind:contains value:"ANTHROPIC_MAGIC_STRING_"`
`body.html.raw`	contains	`ANTHROPIC_MAGIC_STRING_`	`field:"body.html.raw" kind:contains value:"ANTHROPIC_MAGIC_STRING_"`
`body.plain.raw`	contains	`ANTHROPIC_MAGIC_STRING_`	`field:"body.plain.raw" kind:contains value:"ANTHROPIC_MAGIC_STRING_"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`