Detection rules › Sublime MQL
Job scam (unsolicited sender)
Detects job scam attempts by analyzing the message body text from an unsolicited sender.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("job_scam") and .confidence == "high"
)
)
and (
any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "financial"
)
or strings.icontains(body.current_thread.text, "salary package")
or strings.icontains(body.current_thread.text, "kindly")
or (
(
any(ml.nlu_classifier(body.current_thread.text).entities,
.name in ("greeting", "salutation")
)
or sender.email.domain.root_domain in $free_email_providers
)
and (
(
length(recipients.to) == 0
or length(recipients.bcc) > 0
or (
all(recipients.to, .email.domain.valid == false)
and all(recipients.cc, .email.domain.valid == false)
)
)
)
)
)
// negating income / job verification senders
and not (
sender.email.domain.root_domain in ('loandepot.com', 'sofi.com')
and headers.auth_summary.dmarc.pass
)
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Detects job scam attempts by analyzing the message body text from an unsolicited sender.
- inbound message
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('job_scam')
- .confidence is 'high'
any of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'financial'
- body.current_thread.text contains 'salary package'
- body.current_thread.text contains 'kindly'
all of:
any of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name in ('greeting', 'salutation')
- sender.email.domain.root_domain in $free_email_providers
any of:
- length(recipients.to) is 0
- length(recipients.bcc) > 0
all of:
all of
recipients.towhere:- .email.domain.valid is False
all of
recipients.ccwhere:- .email.domain.valid is False
not:
all of:
- sender.email.domain.root_domain in ('loandepot.com', 'sofi.com')
- headers.auth_summary.dmarc.pass
any of:
not:
- profile.by_sender().solicited
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, recipients.bcc, recipients.cc, recipients.cc[].email.domain.valid, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, strings.icontains. Reference lists: $free_email_providers.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | member | job_scam |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | financial |
strings.icontains | substring | salary package |
strings.icontains | substring | kindly |
ml.nlu_classifier(body.current_thread.text).entities[].name | member | greeting |
ml.nlu_classifier(body.current_thread.text).entities[].name | member | salutation |
sender.email.domain.root_domain | member | loandepot.com |
sender.email.domain.root_domain | member | sofi.com |