Detection rules › Sublime MQL

Sublime MQL rules: beta

Rule	Severity
beta.DLP: Australia ABN	`high`
beta.DLP: Australia Bank Account	`high`
beta.DLP: Australia Driver's License	`high`
beta.DLP: Australia Medicare	`high`
beta.DLP: Australia Passport Number	`high`
beta.DLP: Australia Tax File Number	`high`
beta.DLP: Austria VAT	`high`
beta.DLP: AWS Access Key	`high`
beta.DLP: Basic Auth Header	`high`
beta.DLP: Belgium VAT	`high`
beta.DLP: Canada Bank Account	`high`
beta.DLP: Canada Driver's License	`high`
beta.DLP: Canada Health Service Number	`high`
beta.DLP: Canada Passport Number	`high`
beta.DLP: Canada PHIN	`high`
beta.DLP: Canadian Social Insurance Number (SIN)	`high`
beta.DLP: China Resident ID	`high`
beta.DLP: Crypto Wallet Address	`high`
beta.DLP: DEA Number	`high`
beta.DLP: Finland European Health Insurance	`high`
beta.DLP: France Bank Account	`high`
beta.DLP: France Driver's License	`high`
beta.DLP: France National ID (CNI)	`high`
beta.DLP: France Passport Number	`high`
beta.DLP: France Social Security Number (INSEE)	`high`
beta.DLP: France VAT	`high`
beta.DLP: Germany Identity Card (Personalausweis)	`high`
beta.DLP: Germany Passport Number	`high`
beta.DLP: Germany Tax ID (Steueridentifikationsnummer)	`high`
beta.DLP: Germany VAT	`high`
beta.DLP: GitHub Token	`high`
beta.DLP: Google / GCP API Key	`high`
beta.DLP: Hungary TAJ	`high`
beta.DLP: Hungary VAT	`high`
beta.DLP: IBAN Code	`high`
beta.DLP: ICD-10 Code	`high`
beta.DLP: ICD-9 Code	`high`
beta.DLP: Japan Driver's License	`high`
beta.DLP: Japan MyNumber ID	`high`
beta.DLP: Japan Passport Number	`high`
beta.DLP: JSON Web Token (JWT)	`high`
beta.DLP: Luxembourg Non-Natural ID	`high`
beta.DLP: MAC Address	`high`
beta.DLP: National Provider Identifier (NPI)	`high`
beta.DLP: Netherlands BSN / Tax ID	`high`
beta.DLP: Netherlands VAT	`high`
beta.DLP: New Zealand Bank Account	`high`
beta.DLP: New Zealand MOH	`high`
beta.DLP: NHS Number	`high`
beta.DLP: OAuth Client Secret	`high`
beta.DLP: PCI US Credit Card Number (Any Network)	`high`
beta.DLP: Poland REGON	`high`
beta.DLP: Private Key	`high`
beta.DLP: Singapore NRIC	`high`
beta.DLP: Singapore UEN	`high`
beta.DLP: Slack Access Token	`high`
beta.DLP: South Korea Resident Registration Number	`high`
beta.DLP: Spain Bank Account	`high`
beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID	`high`
beta.DLP: Spain Passport Number	`high`
beta.DLP: SSL/TLS Certificate	`high`
beta.DLP: Sweden Personnummer / Tax ID	`high`
beta.DLP: SWIFT/BIC Code	`high`
beta.DLP: UK Driver's License	`high`
beta.DLP: UK National Insurance Number	`high`
beta.DLP: UK Passport	`high`
beta.DLP: UK UTR (Tax)	`high`
beta.DLP: US ABA Routing Number	`high`
beta.DLP: US Bank Account Number	`medium`
beta.DLP: US Driver's License	`high`
beta.DLP: US Individual Taxpayer Identification Number (ITIN)	`high`
beta.DLP: US Medicare Beneficiary ID	`high`
beta.DLP: US Passport Number	`high`
beta.DLP: US Social Security Number (SSN)	`high`
beta.DLP: Vehicle VIN	`high`
DLP - Clear-Text Credentials Outbound	`critical`

beta.DLP: Australia ABN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Business Numbers (ABN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_abn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_abn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_abn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_abn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian Business Numbers (ABN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_abn" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_abn" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_abn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_abn" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_abn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_abn\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_abn\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_abn\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_abn\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_bank_account" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_bank_account" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_bank_account" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_driver_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_driver_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_driver_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Medicare

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Medicare numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_medicare" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_medicare" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_medicare" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_medicare" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian Medicare numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_medicare" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_medicare" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_medicare" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_medicare" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_medicare`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_medicare\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_medicare\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_medicare\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_medicare\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Australia Tax File Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Australian Tax File Numbers (TFN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "au_tfn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "au_tfn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "au_tfn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "au_tfn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Australian Tax File Numbers (TFN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "au_tfn" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "au_tfn" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "au_tfn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "au_tfn" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`au_tfn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"au_tfn\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"au_tfn\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"au_tfn\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"au_tfn\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Austria VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Austrian VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "at_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "at_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "at_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "at_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Austrian VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "at_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "at_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "at_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "at_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`at_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"at_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"at_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"at_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"at_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: AWS Access Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing AWS access keys.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "aws_access_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "aws_access_key" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing AWS access keys.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "aws_access_key" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "aws_access_key" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "aws_access_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "aws_access_key" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"aws_access_key\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"aws_access_key\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"aws_access_key\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"aws_access_key\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Basic Auth Header

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing basic authentication headers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "http_authorization_header" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "http_authorization_header" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing basic authentication headers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "http_authorization_header" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "http_authorization_header" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "http_authorization_header" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "http_authorization_header" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"http_authorization_header\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"http_authorization_header\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"http_authorization_header\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"http_authorization_header\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Belgium VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Belgian VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "be_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "be_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "be_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "be_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Belgian VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "be_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "be_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "be_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "be_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`be_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"be_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"be_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"be_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"be_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ca_bank_account" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ca_bank_account" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ca_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ca_bank_account" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"ca_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"ca_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ca_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ca_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ca_driver_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ca_driver_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ca_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ca_driver_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"ca_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"ca_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ca_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ca_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Health Service Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian health service numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_health_service" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_health_service" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_health_service" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_health_service" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian health service numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ca_health_service" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ca_health_service" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ca_health_service" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ca_health_service" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_health_service`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"ca_health_service\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"ca_health_service\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ca_health_service\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ca_health_service\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ca_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ca_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ca_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ca_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"ca_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"ca_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ca_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ca_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canada PHIN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian Personal Health Identification Numbers (PHIN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ca_phin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ca_phin" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "ca_phin" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "ca_phin" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian Personal Health Identification Numbers (PHIN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ca_phin" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ca_phin" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ca_phin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ca_phin" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ca_phin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"ca_phin\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"ca_phin\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ca_phin\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ca_phin\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Canadian Social Insurance Number (SIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Canadian Social Insurance Numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "canadian_sin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "canadian_sin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing Canadian Social Insurance Numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "canadian_sin" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "canadian_sin" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "canadian_sin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "canadian_sin" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`canadian_sin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"canadian_sin\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"canadian_sin\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"canadian_sin\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"canadian_sin\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: China Resident ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Chinese Resident Identity Card numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "cn_prc_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "cn_prc_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "cn_prc_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "cn_prc_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Chinese Resident Identity Card numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "cn_prc_id" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "cn_prc_id" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "cn_prc_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "cn_prc_id" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`cn_prc_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"cn_prc_id\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"cn_prc_id\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"cn_prc_id\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"cn_prc_id\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Crypto Wallet Address

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing cryptocurrency wallet addresses.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing cryptocurrency wallet addresses.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "crypto_wallet_address" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "crypto_wallet_address" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "crypto_wallet_address" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "crypto_wallet_address" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`crypto_wallet_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"crypto_wallet_address\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"crypto_wallet_address\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"crypto_wallet_address\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"crypto_wallet_address\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: DEA Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Drug Enforcement Administration (DEA) numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_dea_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_dea_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_dea_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_dea_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing US Drug Enforcement Administration (DEA) numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_dea_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_dea_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_dea_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_dea_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_dea_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"us_dea_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"us_dea_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_dea_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_dea_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Finland European Health Insurance

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Finnish European Health Insurance card numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fi_european_health_insurance" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Finnish European Health Insurance card numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fi_european_health_insurance" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fi_european_health_insurance" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fi_european_health_insurance" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fi_european_health_insurance" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fi_european_health_insurance`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fi_european_health_insurance\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fi_european_health_insurance\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fi_european_health_insurance\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fi_european_health_insurance\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_bank_account" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_bank_account" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_bank_account" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_driver_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_driver_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_driver_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France National ID (CNI)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French national identity card numbers (CNI).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_cni" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_cni" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_cni" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_cni" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French national identity card numbers (CNI).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_cni" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_cni" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_cni" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_cni" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_cni`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_cni\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_cni\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_cni\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_cni\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France Social Security Number (INSEE)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French social security numbers (INSEE).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_insee" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_insee" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_insee" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_insee" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French social security numbers (INSEE).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_insee" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_insee" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_insee" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_insee" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_insee`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_insee\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_insee\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_insee\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_insee\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: France VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing French VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "fr_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "fr_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "fr_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "fr_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing French VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "fr_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "fr_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "fr_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "fr_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`fr_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"fr_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"fr_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"fr_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"fr_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Identity Card (Personalausweis)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German national identity card numbers (Personalausweis).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_personalausweis" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_personalausweis" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_personalausweis" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_personalausweis" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing German national identity card numbers (Personalausweis).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "de_personalausweis" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "de_personalausweis" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "de_personalausweis" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "de_personalausweis" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_personalausweis`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"de_personalausweis\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"de_personalausweis\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"de_personalausweis\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"de_personalausweis\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing German passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "de_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "de_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "de_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "de_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"de_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"de_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"de_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"de_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany Tax ID (Steueridentifikationsnummer)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German tax identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_tax_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_tax_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_tax_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_tax_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing German tax identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "de_tax_id" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "de_tax_id" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "de_tax_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "de_tax_id" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_tax_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"de_tax_id\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"de_tax_id\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"de_tax_id\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"de_tax_id\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Germany VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing German VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "de_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "de_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "de_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "de_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing German VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "de_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "de_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "de_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "de_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`de_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"de_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"de_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"de_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"de_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: GitHub Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing GitHub tokens.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "github_token" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "github_token" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing GitHub tokens.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "github_token" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "github_token" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "github_token" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "github_token" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"github_token\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"github_token\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"github_token\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"github_token\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Google / GCP API Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Google or GCP API keys.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "google_api_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "google_api_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "google_api_key" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "google_api_key" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Google or GCP API keys.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "google_api_key" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "google_api_key" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "google_api_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "google_api_key" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`google_api_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"google_api_key\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"google_api_key\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"google_api_key\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"google_api_key\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Hungary TAJ

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Hungarian social security (TAJ) numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "hu_taj" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "hu_taj" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "hu_taj" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "hu_taj" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Hungarian social security (TAJ) numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "hu_taj" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "hu_taj" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "hu_taj" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "hu_taj" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`hu_taj`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"hu_taj\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"hu_taj\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"hu_taj\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"hu_taj\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Hungary VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Hungarian VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "hu_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "hu_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "hu_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "hu_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Hungarian VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "hu_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "hu_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "hu_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "hu_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`hu_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"hu_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"hu_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"hu_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"hu_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: IBAN Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing IBAN codes.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "iban_code" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "iban_code" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing IBAN codes.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "iban_code" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "iban_code" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "iban_code" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "iban_code" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`iban_code`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"iban_code\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"iban_code\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"iban_code\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"iban_code\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-10 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-10 medical diagnosis codes.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd10" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd10" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing ICD-10 medical diagnosis codes.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_icd10" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_icd10" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_icd10" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_icd10" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd10`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_icd10\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_icd10\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_icd10\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_icd10\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: ICD-9 Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing ICD-9 medical diagnosis codes.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_icd9" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_icd9" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing ICD-9 medical diagnosis codes.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_icd9" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_icd9" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_icd9" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_icd9" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_icd9`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_icd9\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_icd9\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_icd9\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_icd9\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_driver_license" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_driver_license" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Japanese driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "jp_driver_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "jp_driver_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "jp_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "jp_driver_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"jp_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"jp_driver_license\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"jp_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"jp_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan MyNumber ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese My Number (Individual Number) identifiers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_my_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_my_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_my_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_my_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Japanese My Number (Individual Number) identifiers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "jp_my_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "jp_my_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "jp_my_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "jp_my_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_my_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"jp_my_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"jp_my_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"jp_my_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"jp_my_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Japan Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Japanese passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jp_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jp_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jp_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jp_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Japanese passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "jp_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "jp_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "jp_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "jp_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jp_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"jp_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"jp_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"jp_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"jp_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: JSON Web Token (JWT)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing JSON Web Tokens (JWT).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "jwt" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "jwt" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "jwt" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "jwt" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing JSON Web Tokens (JWT).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "jwt" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "jwt" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "jwt" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "jwt" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`jwt`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"jwt\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"jwt\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"jwt\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"jwt\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Luxembourg Non-Natural ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Luxembourg non-natural person identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Luxembourg non-natural person identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`luxembourg_nonnatural_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"luxembourg_nonnatural_id\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"luxembourg_nonnatural_id\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"luxembourg_nonnatural_id\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"luxembourg_nonnatural_id\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: MAC Address

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing MAC addresses.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Network Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing MAC addresses.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "mac_address" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "mac_address" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "mac_address" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "mac_address" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`mac_address`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"mac_address\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"mac_address\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"mac_address\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"mac_address\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: National Provider Identifier (NPI)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US National Provider Identifier (NPI) numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_npi" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_npi" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_npi" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_npi" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing US National Provider Identifier (NPI) numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_npi" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_npi" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_npi" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_npi" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_npi`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"us_npi\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"us_npi\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_npi\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_npi\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Netherlands BSN / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Dutch Burger Service Numbers (BSN) or tax identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nl_bsn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nl_bsn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nl_bsn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nl_bsn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Dutch Burger Service Numbers (BSN) or tax identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "nl_bsn" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "nl_bsn" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "nl_bsn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "nl_bsn" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nl_bsn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"nl_bsn\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"nl_bsn\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"nl_bsn\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"nl_bsn\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Netherlands VAT

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Netherlands VAT numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nl_vat" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nl_vat" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nl_vat" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nl_vat" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Netherlands VAT numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "nl_vat" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "nl_vat" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "nl_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "nl_vat" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nl_vat`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"nl_vat\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"nl_vat\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"nl_vat\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"nl_vat\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: New Zealand Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing New Zealand bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nz_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nz_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nz_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nz_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing New Zealand bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "nz_bank_account" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "nz_bank_account" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "nz_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "nz_bank_account" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nz_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"nz_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"nz_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"nz_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"nz_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: New Zealand MOH

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing New Zealand Ministry of Health numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Healthcare

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nz_moh" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nz_moh" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "nz_moh" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "nz_moh" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing New Zealand Ministry of Health numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "nz_moh" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "nz_moh" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "nz_moh" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "nz_moh" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nz_moh`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"nz_moh\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"nz_moh\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"nz_moh\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"nz_moh\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: NHS Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK NHS numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "nhs_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "nhs_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing UK NHS numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "nhs_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "nhs_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "nhs_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "nhs_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`nhs_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"nhs_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"nhs_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"nhs_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"nhs_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: OAuth Client Secret

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing OAuth client secrets.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "oauth_client_secret" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "oauth_client_secret" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing OAuth client secrets.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "oauth_client_secret" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "oauth_client_secret" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "oauth_client_secret" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "oauth_client_secret" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"oauth_client_secret\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"oauth_client_secret\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"oauth_client_secret\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"oauth_client_secret\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: PCI US Credit Card Number (Any Network)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing credit card numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "credit_card_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "credit_card_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing credit card numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "credit_card_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "credit_card_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "credit_card_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "credit_card_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`credit_card_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"credit_card_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"credit_card_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"credit_card_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"credit_card_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Poland REGON

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Polish REGON business registration numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "pl_regon" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "pl_regon" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "pl_regon" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "pl_regon" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Polish REGON business registration numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "pl_regon" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "pl_regon" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "pl_regon" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "pl_regon" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`pl_regon`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"pl_regon\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"pl_regon\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"pl_regon\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"pl_regon\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Private Key

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing private keys.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "private_key" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "private_key" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing private keys.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "private_key" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "private_key" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "private_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "private_key" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"private_key\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"private_key\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"private_key\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"private_key\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Singapore NRIC

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Singapore National Registration Identity Card (NRIC) numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "sg_nric" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "sg_nric" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "sg_nric" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "sg_nric" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Singapore National Registration Identity Card (NRIC) numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "sg_nric" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "sg_nric" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "sg_nric" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "sg_nric" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`sg_nric`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"sg_nric\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"sg_nric\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"sg_nric\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"sg_nric\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Singapore UEN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Singapore Unique Entity Numbers (UEN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "sg_uen" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "sg_uen" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "sg_uen" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "sg_uen" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Singapore Unique Entity Numbers (UEN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "sg_uen" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "sg_uen" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "sg_uen" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "sg_uen" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`sg_uen`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"sg_uen\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"sg_uen\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"sg_uen\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"sg_uen\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Slack Access Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Slack access tokens.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Secrets & Credentials

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "slack_access_token" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "slack_access_token" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "slack_access_token" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "slack_access_token" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Slack access tokens.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "slack_access_token" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "slack_access_token" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "slack_access_token" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "slack_access_token" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`slack_access_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"slack_access_token\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"slack_access_token\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"slack_access_token\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"slack_access_token\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: South Korea Resident Registration Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing South Korean Resident Registration Numbers (RRN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "kr_rrn" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "kr_rrn" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "kr_rrn" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "kr_rrn" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing South Korean Resident Registration Numbers (RRN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "kr_rrn" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "kr_rrn" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "kr_rrn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "kr_rrn" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`kr_rrn`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"kr_rrn\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"kr_rrn\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"kr_rrn\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"kr_rrn\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Spain Bank Account

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Spanish bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "es_bank_account" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "es_bank_account" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "es_bank_account" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "es_bank_account" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Spanish bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "es_bank_account" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "es_bank_account" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "es_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "es_bank_account" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`es_bank_account`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"es_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"es_bank_account\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"es_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"es_bank_account\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Spanish national identity, passport, social security, or tax identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "es_dni_nie_nif" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Spanish national identity, passport, social security, or tax identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "es_dni_nie_nif" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "es_dni_nie_nif" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "es_dni_nie_nif" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "es_dni_nie_nif" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`es_dni_nie_nif`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"es_dni_nie_nif\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"es_dni_nie_nif\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"es_dni_nie_nif\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"es_dni_nie_nif\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Spain Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Spanish passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "es_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "es_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "es_passport_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "es_passport_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Spanish passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "es_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "es_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "es_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "es_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`es_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`es_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`es_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`es_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"es_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"es_passport_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"es_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"es_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SSL/TLS Certificate

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing SSL/TLS certificates.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure, DLP: Infrastructure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "ssl_certificate" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "ssl_certificate" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing SSL/TLS certificates.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "ssl_certificate" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "ssl_certificate" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "ssl_certificate" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "ssl_certificate" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`ssl_certificate`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"ssl_certificate\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"ssl_certificate\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"ssl_certificate\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"ssl_certificate\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Sweden Personnummer / Tax ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Swedish personal identity numbers (personnummer) or tax identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Personal Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "se_personnummer" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "se_personnummer" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "se_personnummer" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "se_personnummer" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Swedish personal identity numbers (personnummer) or tax identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "se_personnummer" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "se_personnummer" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "se_personnummer" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "se_personnummer" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`se_personnummer`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"se_personnummer\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"se_personnummer\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"se_personnummer\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"se_personnummer\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: SWIFT/BIC Code

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Financial Data

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "swift_bic" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "swift_bic" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "swift_bic" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "swift_bic" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "swift_bic" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "swift_bic" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`swift_bic`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"swift_bic\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"swift_bic\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"swift_bic\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"swift_bic\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_drivers_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_drivers_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing UK driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "uk_drivers_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "uk_drivers_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "uk_drivers_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "uk_drivers_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_drivers_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"uk_drivers_license\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"uk_drivers_license\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"uk_drivers_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"uk_drivers_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK National Insurance Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK National Insurance numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_nino" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "uk_nino" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing UK National Insurance numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "uk_nino" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "uk_nino" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "uk_nino" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "uk_nino" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_nino`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"uk_nino\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"uk_nino\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"uk_nino\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"uk_nino\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK Passport

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: GDPR

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_passport_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_passport_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing UK passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "uk_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "uk_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "uk_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "uk_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"uk_passport_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"uk_passport_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"uk_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"uk_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: UK UTR (Tax)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing UK Unique Taxpayer Reference numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: GDPR

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "uk_utr" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "uk_utr" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing UK Unique Taxpayer Reference numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "uk_utr" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "uk_utr" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "uk_utr" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "uk_utr" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`uk_utr`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"uk_utr\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"uk_utr\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"uk_utr\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"uk_utr\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US ABA Routing Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US ABA routing numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_aba_routing_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_aba_routing_number" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing US ABA routing numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_aba_routing_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_aba_routing_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_aba_routing_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_aba_routing_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_aba_routing_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"us_aba_routing_number\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"us_aba_routing_number\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_aba_routing_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_aba_routing_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Bank Account Number

Severity: medium
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US bank account numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PCI, DLP: Financial

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_bank_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_bank_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing US bank account numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_bank_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_bank_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_bank_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_bank_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_bank_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_bank_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_bank_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_bank_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_bank_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Driver's License

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US driver's license numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_driver_license" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_driver_license" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing US driver's license numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_driver_license" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_driver_license" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_driver_license" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_driver_license`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_driver_license\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_driver_license\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_driver_license\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Individual Taxpayer Identification Number (ITIN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Individual Taxpayer Identification Numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_itin" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_itin" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing US Individual Taxpayer Identification Numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_itin" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_itin" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_itin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_itin" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_itin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_itin\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_itin\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_itin\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_itin\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Medicare Beneficiary ID

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Medicare Beneficiary Identification numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: HIPAA

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing US Medicare Beneficiary Identification numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_medicare_beneficiary_id`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"us_medicare_beneficiary_id\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"us_medicare_beneficiary_id\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_medicare_beneficiary_id\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_medicare_beneficiary_id\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Passport Number

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US passport numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "us_passport_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "us_passport_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing US passport numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "us_passport_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "us_passport_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "us_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "us_passport_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`us_passport_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"us_passport_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"us_passport_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"us_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"us_passport_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: US Social Security Number (SSN)

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing US Social Security Numbers.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: PII, DLP: HIPAA

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "social_security_number" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "social_security_number" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Detection Logic

Scope: outbound message.

Detects messages containing US Social Security Numbers.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "social_security_number" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "social_security_number" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "social_security_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "social_security_number" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`social_security_number`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n    (\n      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n        .type == \"social_security_number\" and .confidence in (\"medium\", \"high\")\n      )\n      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n        .type == \"social_security_number\" and .confidence in (\"medium\", \"high\")\n      )\n    )\n  )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"social_security_number\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"social_security_number\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

beta.DLP: Vehicle VIN

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Vehicle Identification Numbers (VIN).

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Asset Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "vehicle_vin" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "vehicle_vin" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "vehicle_vin" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "vehicle_vin" and .confidence in ("medium", "high")
        )
      )
    )
  )
)

Detection Logic

Scope: outbound message.

Detects messages containing Vehicle Identification Numbers (VIN).

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type == "vehicle_vin" and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type == "vehicle_vin" and .confidence in ("medium", "high") )
- any of attachments where:
  - any(file.explode(.), ( any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type == "vehicle_vin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type == "vehicle_vin" and .confidence in ("medium", "high") ) ) )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode.

Indicators Matched (12)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	equals	`vehicle_vin`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
       macro "any(file.explode(.),\n      (\n        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n          .type == \"vehicle_vin\" and .confidence in (\"medium\", \"high\")\n        )\n        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n          .type == \"vehicle_vin\" and .confidence in (\"medium\", \"high\")\n        )\n      )\n    )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n    .type == \"vehicle_vin\" and .confidence in (\"medium\", \"high\")\n  )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n    .type == \"vehicle_vin\" and .confidence in (\"medium\", \"high\")\n  )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

DLP - Clear-Text Credentials Outbound

Severity: critical
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects outbound emails containing clear-text credentials in the body, subject, or attachments using ML extraction. Covers private keys, AWS access keys, GitHub tokens, HTTP Basic auth headers, and OAuth client secrets. Attachment content is scanned via ml_extract on both raw text and OCR surfaces, catching credentials embedded in images or binary document formats. Note: GCP API keys, Slack tokens, JWTs, and database connection strings are not covered by ml_extract and are intentionally omitted to avoid regex FPs.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	DLP: Credential Exposure

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

attachments
body
body.current_thread
subject
type

Rule Body

type.outbound
and (
    // ── ML extraction: body ────────────────────────────────────────────────

    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── ML extraction: subject ─────────────────────────────────────────────

    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── Credential-bearing file types by extension and name ────────────────

    or any(attachments,
        .file_extension in~ ("env", "pem", "key", "p12", "pfx", "jks", "keystore", "ovpn")
        or strings.icontains(.file_name, "credential")
        or strings.icontains(.file_name, "secret")
        or strings.icontains(.file_name, "password")
    )

    // ── ML extraction: attachments (raw text + OCR) ────────────────────────

    or any(attachments,
        any(file.explode(.),
            any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
            or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
        )
    )
)

Detection Logic

Scope: outbound message.

outbound message
any of:
- any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") and .confidence in ("medium", "high") )
- any(beta.ml_extract_sensitive_information(subject.subject).elements, .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") and .confidence in ("medium", "high") )
- any of attachments where any holds:
  - .file_extension in ('env', 'pem', 'key', 'p12', 'pfx', 'jks', 'keystore', 'ovpn')
  - .file_name contains 'credential'
  - .file_name contains 'secret'
  - .file_name contains 'password'
- any of attachments where:
  - any(file.explode(.), any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") and .confidence in ("medium", "high") ) )

Inspects: attachments[].file_extension, attachments[].file_name, body.current_thread.text, subject.subject, type.outbound. Sensors: beta.ml_extract_sensitive_information, file.explode, strings.icontains.

Indicators Matched (39)

Field	Match	Value
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(body.current_thread.text).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(subject.subject).elements[].type`	member	`oauth_client_secret`

27 more

`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(subject.subject).elements[].confidence`	member	`high`
`attachments[].file_extension`	member	`env`
`attachments[].file_extension`	member	`pem`
`attachments[].file_extension`	member	`key`
`attachments[].file_extension`	member	`p12`
`attachments[].file_extension`	member	`pfx`
`attachments[].file_extension`	member	`jks`
`attachments[].file_extension`	member	`keystore`
`attachments[].file_extension`	member	`ovpn`
`strings.icontains`	substring	`credential`
`strings.icontains`	substring	`secret`
`strings.icontains`	substring	`password`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.strings.raw).elements[].confidence`	member	`high`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`private_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`aws_access_key`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`github_token`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`http_authorization_header`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].type`	member	`oauth_client_secret`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`medium`
`beta.ml_extract_sensitive_information(file.explode(attachments[])[].scan.ocr.raw).elements[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(attachments)
      or
        attachments.file_extension in ["env", "jks", "key", "keystore", "ovpn", "p12", "pem", "pfx"]
        attachments.file_name contains "credential"
        attachments.file_name contains "password"
        attachments.file_name contains "secret"
    any(attachments)
       macro "any(file.explode(.),\n            any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,\n                .type in (\"private_key\", \"aws_access_key\", \"github_token\", \"http_authorization_header\", \"oauth_client_secret\")\n                and .confidence in (\"medium\", \"high\")\n            )\n            or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,\n                .type in (\"private_key\", \"aws_access_key\", \"github_token\", \"http_authorization_header\", \"oauth_client_secret\")\n                and .confidence in (\"medium\", \"high\")\n            )\n        )"
     macro "any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,\n        .type in (\"private_key\", \"aws_access_key\", \"github_token\", \"http_authorization_header\", \"oauth_client_secret\")\n        and .confidence in (\"medium\", \"high\")\n    )"
     macro "any(beta.ml_extract_sensitive_information(subject.subject).elements,\n        .type in (\"private_key\", \"aws_access_key\", \"github_token\", \"http_authorization_header\", \"oauth_client_secret\")\n        and .confidence in (\"medium\", \"high\")\n    )"
  type.outbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

Back to all Sublime MQL rules

Sublime MQL rules: beta

beta.DLP: Australia ABN

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Bank Account

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Driver's License

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Medicare

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Passport Number

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Australia Tax File Number

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: Austria VAT

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Indicators

beta.DLP: AWS Access Key

Threat Classification

Telemetry Coverage

Message Attributes

Rule Body

Detection Logic

Indicators Matched (12)

Stages and Predicates

Stage 1: mql_rule

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`

Stage 1: `mql_rule`