Detection rules › Sublime MQL

Credential theft with 'safe content' deception and social engineering topics

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in (
        "Reminders and Notifications",
        "Secure Message",
        "Security and Authentication",
        "Voicemail Call and Missed Call Notifications",
        "E-Signature",
        "Financial Communications"
      )
  )
  or (
    length(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                           .name not in ("org", "recipient", "sender")
                    ),
                    .name
           )
    ) > 0
    and all(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                            .name not in ("org", "recipient", "sender")
                     ),
                     .name
            ),
            .name in ("request", "financial", "urgency")
    )
  )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Advertising and Promotions",
              "Newsletters and Digests",
              "News and Current Events",
              "Travel and Transportation"
            )
)
// check only the first line of the email
and any(regex.iextract(body.current_thread.text, "^[^\r\n]*"),
        length(.full_match) < 500
        and strings.ilike(strings.replace_confusables(.full_match),
                          "*safe content*",
                          "*safe sender*",
                          "*trusted sender*"
        )
        and not regex.icontains(.full_match,
                                "add.{0,50} to.{0,50}(address book|safe senders? list)"
        )
)

Detection logic

Scope: inbound message.

Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust.

  1. inbound message
  2. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'
  3. any of:
    • any of ml.nlu_classifier(body.current_thread.text).topics where:
      • .name in ('Reminders and Notifications', 'Secure Message', 'Security and Authentication', 'Voicemail Call and Missed Call Notifications', 'E-Signature', 'Financial Communications')
    • all of:
      • length(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities, .name not in ('org', 'recipient', 'sender')), .name)) > 0
      • all of distinct(...) where:
        • .name in ('request', 'financial', 'urgency')
  4. not:
    • any of ml.nlu_classifier(body.current_thread.text).topics where:
      • .name in ('Advertising and Promotions', 'Newsletters and Digests', 'News and Current Events', 'Travel and Transportation')
  5. any of regex.iextract(body.current_thread.text) where all hold:
    • length(.full_match) < 500
    • strings.replace_confusables(.full_match) matches any of 3 patterns
      • *safe content*
      • *safe sender*
      • *trusted sender*
    • not:
      • .full_match matches 'add.{0,50} to.{0,50}(address book|safe senders? list)'

Inspects: body.current_thread.text, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, regex.iextract, strings.ilike, strings.replace_confusables.

Indicators matched (22)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).topics[].namememberReminders and Notifications
ml.nlu_classifier(body.current_thread.text).topics[].namememberSecure Message
ml.nlu_classifier(body.current_thread.text).topics[].namememberSecurity and Authentication
ml.nlu_classifier(body.current_thread.text).topics[].namememberVoicemail Call and Missed Call Notifications
ml.nlu_classifier(body.current_thread.text).topics[].namememberE-Signature
ml.nlu_classifier(body.current_thread.text).topics[].namememberFinancial Communications
ml.nlu_classifier(body.current_thread.text).entities[].namememberorg
ml.nlu_classifier(body.current_thread.text).entities[].namememberrecipient
ml.nlu_classifier(body.current_thread.text).entities[].namemembersender
distinct(...)[].namememberrequest
distinct(...)[].namememberfinancial
10 more
distinct(...)[].namememberurgency
ml.nlu_classifier(body.current_thread.text).topics[].namememberAdvertising and Promotions
ml.nlu_classifier(body.current_thread.text).topics[].namememberNewsletters and Digests
ml.nlu_classifier(body.current_thread.text).topics[].namememberNews and Current Events
ml.nlu_classifier(body.current_thread.text).topics[].namememberTravel and Transportation
regex.iextractregex^[^\r\n]*
strings.ilikesubstring*safe content*
strings.ilikesubstring*safe sender*
strings.ilikesubstring*trusted sender*
regex.icontainsregexadd.{0,50} to.{0,50}(address book|safe senders? list)