Detection rules › Sublime MQL
Newly registered sender or reply-to domain with newly registered linked domain
This rule detects inbound emails that contain links and a reply-to address, where either the sender domain or the reply-to domain is newly registered (≤30 days old), and at least one linked domain is also very new (≤14 days old). It flags potential phishing or business email compromise attempts that use recently created infrastructure and reply-to mismatch tactics to bypass trust and impersonate legitimate contacts.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(body.links) > 0
and length(headers.reply_to) > 0
and (
any(headers.reply_to,
network.whois(.email.domain).days_old <= 30
and .email.email != sender.email.email
)
or network.whois(sender.email.domain).days_old <= 30
)
and any(distinct(body.links, .href_url.domain.root_domain),
network.whois(.href_url.domain).days_old < 14
)
Detection logic
Scope: inbound message.
This rule detects inbound emails that contain links and a reply-to address, where either the sender domain or the reply-to domain is newly registered (≤30 days old), and at least one linked domain is also very new (≤14 days old). It flags potential phishing or business email compromise attempts that use recently created infrastructure and reply-to mismatch tactics to bypass trust and impersonate legitimate contacts.
- inbound message
- length(body.links) > 0
- length(headers.reply_to) > 0
any of:
any of
headers.reply_towhere all hold:- network.whois(.email.domain).days_old ≤ 30
- .email.email is not sender.email.email
- network.whois(sender.email.domain).days_old ≤ 30
any of
distinct(body.links)where:- network.whois(.href_url.domain).days_old < 14
Inspects: body.links, body.links[].href_url.domain.root_domain, headers.reply_to, headers.reply_to[].email.domain, headers.reply_to[].email.email, sender.email.domain, sender.email.email, type.inbound. Sensors: network.whois.