Detection rules › Sublime MQL
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
Detects suspicious reply messages with urgent language in sender name or email address, minimal body content, and the sender's email address appearing in previous thread content, indicating a self reply.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
and subject.is_reply
and length(attachments) == 0
// short current thread
and length(body.current_thread.text) < 25
// only 1 previous thread
and length(body.previous_threads) == 1
and any(recipients.to,
.email.domain.root_domain != sender.email.domain.root_domain
)
// urgent or authority based keywords in sender display name or local part
and (
regex.icontains(sender.display_name,
'\b(?:(?:crucial|urgent|immediate|important|quick)(?:ly)?|immediatetask|emergency)\b'
)
or regex.icontains(sender.email.local_part, '(?:task|ceo|executive)')
)
// sender replied to themselves
and any(body.previous_threads, strings.icontains(.preamble, sender.email.email))
Detection logic
Scope: inbound message.
Detects suspicious reply messages with urgent language in sender name or email address, minimal body content, and the sender's email address appearing in previous thread content, indicating a self reply.
- inbound message
- subject.is_reply
- length(attachments) is 0
- length(body.current_thread.text) < 25
- length(body.previous_threads) is 1
any of
recipients.towhere:- .email.domain.root_domain is not sender.email.domain.root_domain
any of:
- sender.display_name matches '\\b(?:(?:crucial|urgent|immediate|important|quick)(?:ly)?|immediatetask|emergency)\\b'
- sender.email.local_part matches '(?:task|ceo|executive)'
any of
body.previous_threadswhere:- strings.icontains(.preamble)
Inspects: body.current_thread.text, body.previous_threads, body.previous_threads[].preamble, recipients.to, recipients.to[].email.domain.root_domain, sender.display_name, sender.email.domain.root_domain, sender.email.email, sender.email.local_part, subject.is_reply, type.inbound. Sensors: regex.icontains, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \b(?:(?:crucial|urgent|immediate|important|quick)(?:ly)?|immediatetask|emergency)\b |
regex.icontains | regex | (?:task|ceo|executive) |