Detection rules › Sublime MQL
Attachment: Credit card application with WhatsApp contact
Detects messages containing promotional credit card offers with attached forms requesting extensive personal information (PII) and directing victims to contact via WhatsApp, indicating potential fraud.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Out of band pivot |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| subject |
| type |
Rule body MQL
type.inbound
// promotional/advertising content targeting financial services
and (
(
regex.icontains(body.current_thread.text,
"credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer"
)
or regex.icontains(subject.subject,
"credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free"
)
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Advertising and Promotions")
)
)
// PII harvesting template in attachments (3+ of these patterns)
and any(attachments,
any(file.explode(.),
3 of (
regex.icontains(.scan.strings.raw, "Credit Card Application"),
regex.icontains(.scan.strings.raw, "Date of Birth"),
regex.icontains(.scan.strings.raw, "[eE]mail"),
regex.icontains(.scan.strings.raw, "[aA]ddress"),
regex.icontains(.scan.strings.raw, "Contact No"),
regex.icontains(.scan.strings.raw, "Pan No"),
regex.icontains(.scan.strings.raw, "ADHAAR"),
regex.icontains(.scan.strings.raw, "Annual.*salary"),
regex.icontains(.scan.strings.raw, "Mother Name"),
regex.icontains(.scan.strings.raw, "Father Name"),
regex.icontains(.scan.strings.raw, "SINGLE.*MARRIED")
)
)
)
// WhatsApp contact method (suspicious for legitimate financial institutions)
and (
regex.icontains(body.current_thread.text, "whatsapp")
or any(attachments,
any(file.explode(.), regex.icontains(.scan.qr.url.url, "wa\\.me"))
)
or any(file.explode(file.message_screenshot()),
regex.icontains(.scan.qr.url.url, "wa\\.me")
)
)
Detection logic
Scope: inbound message.
Detects messages containing promotional credit card offers with attached forms requesting extensive personal information (PII) and directing victims to contact via WhatsApp, indicating potential fraud.
- inbound message
all of:
any of:
- body.current_thread.text matches 'credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer'
- subject.subject matches 'credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Advertising and Promotions')
any of
attachmentswhere:any of
file.explode(.)where:at least 3 of 11: .scan.strings.raw matches any of 11 patterns
Credit Card ApplicationDate of Birth[eE]mail[aA]ddressContact NoPan NoADHAARAnnual.*salaryMother NameFather NameSINGLE.*MARRIED
any of:
- body.current_thread.text matches 'whatsapp'
any of
attachmentswhere:any of
file.explode(.)where:- .scan.qr.url.url matches 'wa\\\\.me'
any of
file.explode(...)where:- .scan.qr.url.url matches 'wa\\\\.me'
Inspects: body.current_thread.text, subject.subject, type.inbound. Sensors: file.explode, file.message_screenshot, ml.nlu_classifier, regex.icontains.
Indicators matched (16)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer |
regex.icontains | regex | credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Advertising and Promotions |
regex.icontains | regex | Credit Card Application |
regex.icontains | regex | Date of Birth |
regex.icontains | regex | [eE]mail |
regex.icontains | regex | [aA]ddress |
regex.icontains | regex | Contact No |
regex.icontains | regex | Pan No |
regex.icontains | regex | ADHAAR |
regex.icontains | regex | Annual.*salary |
regex.icontains | regex | Mother Name |
4 more
regex.icontains | regex | Father Name |
regex.icontains | regex | SINGLE.*MARRIED |
regex.icontains | regex | whatsapp |
regex.icontains | regex | wa\\.me |