detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: asr

RuleSeverity
Newly registered sender or reply-to domain with newly registered linked domainmedium
Suspicious mailer received from Gmail serverslow

Newly registered sender or reply-to domain with newly registered linked domain

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects inbound emails that contain links and a reply-to address, where either the sender domain or the reply-to domain is newly registered (≤30 days old), and at least one linked domain is also very new (≤14 days old). It flags potential phishing or business email compromise attempts that use recently created infrastructure and reply-to mismatch tactics to bypass trust and impersonate legitimate contacts.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesSocial engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.links
  • headers
  • headers.reply_to
  • sender.email
  • type

Rule body

type.inbound
and length(body.links) > 0
and length(headers.reply_to) > 0
and (
  any(headers.reply_to,
      network.whois(.email.domain).days_old <= 30
      and .email.email != sender.email.email
  )
  or network.whois(sender.email.domain).days_old <= 30
)
and any(distinct(body.links, .href_url.domain.root_domain),
        network.whois(.href_url.domain).days_old < 14
)

Detection logic

Scope: inbound message.

This rule detects inbound emails that contain links and a reply-to address, where either the sender domain or the reply-to domain is newly registered (≤30 days old), and at least one linked domain is also very new (≤14 days old). It flags potential phishing or business email compromise attempts that use recently created infrastructure and reply-to mismatch tactics to bypass trust and impersonate legitimate contacts.

  1. inbound message
  2. length(body.links) > 0
  3. length(headers.reply_to) > 0
  4. any of:
    • any of headers.reply_to where all hold:
      • network.whois(.email.domain).days_old ≤ 30
      • .email.email is not sender.email.email
    • network.whois(sender.email.domain).days_old ≤ 30
  5. any of distinct(body.links) where:
    • network.whois(.href_url.domain).days_old < 14

Inspects: body.links, body.links[].href_url.domain.root_domain, headers.reply_to, headers.reply_to[].email.domain, headers.reply_to[].email.email, sender.email.domain, sender.email.email, type.inbound. Sensors: network.whois.

Stages and Predicates

Stage 1: mql_rule

and
  or
    any(headers.reply_to)
      and
        headers.reply_to.email.email cross_field_compare "sender.email.email"
        network.whois func_call "network.whois(headers.reply_to[].email.domain).days_old <= 30"
    network.whois func_call "network.whois(sender.email.domain).days_old <= 30"
  any(distinct(body.links))
    network.whois func_call "network.whois(distinct(body.links)[].href_url.domain).days_old < 14"
  body.links length_compare "0"
  headers.reply_to length_compare "0"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Suspicious mailer received from Gmail servers

#
Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Spam
Tactics and techniquesFree email provider, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • headers
  • headers.hops
  • headers.return_path
  • type

Rule body

type.inbound
and (
  strings.ilike(headers.mailer,
                "Microsoft CDO for Windows 2000",
                "PHPMailer*",
                "nodemailer*"
  )
  or any(headers.hops, any(.fields, .value == "Produced By Microsoft MimeOLE"))
)
and (
  any(headers.hops, .index == 0 and .received.server.raw == "smtp.gmail.com")
  or headers.return_path.domain.root_domain in ("gmail.com", "googlemail.com")
)
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.

  1. inbound message
  2. any of:
    • headers.mailer matches any of 3 patterns
      • Microsoft CDO for Windows 2000
      • PHPMailer*
      • nodemailer*
    • any of headers.hops where:
      • any of .fields where:
        • .value is 'Produced By Microsoft MimeOLE'
  3. any of:
    • any of headers.hops where all hold:
      • .index is 0
      • .received.server.raw is 'smtp.gmail.com'
    • headers.return_path.domain.root_domain in ('gmail.com', 'googlemail.com')
  4. not:
    • profile.by_sender().any_messages_benign

Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].value, headers.hops[].index, headers.hops[].received.server.raw, headers.mailer, headers.return_path.domain.root_domain, type.inbound. Sensors: profile.by_sender, strings.ilike.

Indicators matched (7)

FieldMatchValue
strings.ilikesubstringMicrosoft CDO for Windows 2000
strings.ilikesubstringPHPMailer*
strings.ilikesubstringnodemailer*
headers.hops[].fields[].valueequalsProduced By Microsoft MimeOLE
headers.hops[].received.server.rawequalssmtp.gmail.com
headers.return_path.domain.root_domainmembergmail.com
headers.return_path.domain.root_domainmembergooglemail.com

Stages and Predicates

Stage 1: mql_rule

and
  or
    any(headers.hops)
      any(headers.hops.fields)
        headers.hops.fields.value eq "Produced By Microsoft MimeOLE"
    headers.mailer eq "Microsoft CDO for Windows 2000"
    headers.mailer starts_with "PHPMailer"
    headers.mailer starts_with "nodemailer"
  or
    any(headers.hops)
      and
        headers.hops.index eq "0"
        headers.hops.received.server.raw eq "smtp.gmail.com"
    headers.return_path.domain.root_domain in ["gmail.com", "googlemail.com"]
  not
    profile.by_sender func_call "profile.by_sender().any_messages_benign"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
headers.mailerwildcard
  • Microsoft CDO for Windows 2000
  • PHPMailer*
  • nodemailer*
field:"headers.mailer" kind:wildcard
headers.return_path.domain.root_domainin
  • gmail.com
  • googlemail.com
field:"headers.return_path.domain.root_domain" kind:in
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"