Detection rules › Sublime MQL
Anthropic Magic String in HTML
Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Exploit |
Event coverage
| Message attribute |
|---|
| body.html |
| body.plain |
| type |
Rule body MQL
type.inbound
and length(attachments) <= 3
and (
strings.icontains(body.html.raw, 'ANTHROPIC_MAGIC_STRING_')
or strings.icontains(body.plain.raw, 'ANTHROPIC_MAGIC_STRING_')
or strings.icontains(body.html.display_text, 'ANTHROPIC_MAGIC_STRING_')
or any(attachments,
any(file.explode(.),
strings.icontains(.scan.ocr.raw, "ANTHROPIC_MAGIC_STRING_")
or strings.icontains(.scan.strings.raw, "ANTHROPIC_MAGIC_STRING_")
)
)
)
Detection logic
Scope: inbound message.
Detects messages containing the specific test string 'ANTHROPIC_MAGIC_STRING' in the plain text body content.
- inbound message
- length(attachments) ≤ 3
any of:
- body.html.raw contains 'ANTHROPIC_MAGIC_STRING_'
- body.plain.raw contains 'ANTHROPIC_MAGIC_STRING_'
- body.html.display_text contains 'ANTHROPIC_MAGIC_STRING_'
any of
attachmentswhere:any of
file.explode(.)where any holds:- .scan.ocr.raw contains 'ANTHROPIC_MAGIC_STRING_'
- .scan.strings.raw contains 'ANTHROPIC_MAGIC_STRING_'
Inspects: body.html.display_text, body.html.raw, body.plain.raw, type.inbound. Sensors: file.explode, strings.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | ANTHROPIC_MAGIC_STRING_ |