Detection rules › Sublime MQL
Suspicious mailer received from Gmail servers
Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, Spam |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
| Message attribute |
|---|
| headers (collection) |
| headers.hops (collection) |
| headers.return_path |
| type |
Rule body MQL
type.inbound
and (
strings.ilike(headers.mailer,
"Microsoft CDO for Windows 2000",
"PHPMailer*",
"nodemailer*"
)
or any(headers.hops, any(.fields, .value == "Produced By Microsoft MimeOLE"))
)
and (
any(headers.hops, .index == 0 and .received.server.raw == "smtp.gmail.com")
or headers.return_path.domain.root_domain in ("gmail.com", "googlemail.com")
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.
- inbound message
any of:
headers.mailer matches any of 3 patterns
Microsoft CDO for Windows 2000PHPMailer*nodemailer*
any of
headers.hopswhere:any of
.fieldswhere:- .value is 'Produced By Microsoft MimeOLE'
any of:
any of
headers.hopswhere all hold:- .index is 0
- .received.server.raw is 'smtp.gmail.com'
- headers.return_path.domain.root_domain in ('gmail.com', 'googlemail.com')
not:
- profile.by_sender().any_messages_benign
Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].value, headers.hops[].index, headers.hops[].received.server.raw, headers.mailer, headers.return_path.domain.root_domain, type.inbound. Sensors: profile.by_sender, strings.ilike.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | Microsoft CDO for Windows 2000 |
strings.ilike | substring | PHPMailer* |
strings.ilike | substring | nodemailer* |
headers.hops[].fields[].value | equals | Produced By Microsoft MimeOLE |
headers.hops[].received.server.raw | equals | smtp.gmail.com |
headers.return_path.domain.root_domain | member | gmail.com |
headers.return_path.domain.root_domain | member | googlemail.com |