Detection rules › Sublime MQL

Body: PayApp transaction reference pattern

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing PayApp transaction reference numbers in a specific format (PayApp# followed by digits) in either the message body or subject line.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, BEC/Fraud
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and regex.icontains(body.current_thread.text, 'PayApp\s?#\d+')
and regex.icontains(body.current_thread.text, '[a-z0-9\.\+\-]+@[a-z0-9\-]+\.')
and strings.icontains(subject.base, "payapp")

Detection logic

Scope: inbound message.

Detects messages containing PayApp transaction reference numbers in a specific format (PayApp# followed by digits) in either the message body or subject line.

  1. inbound message
  2. body.current_thread.text matches 'PayApp\\s?#\\d+'
  3. body.current_thread.text matches '[a-z0-9\\.\\+\\-]+@[a-z0-9\\-]+\\.'
  4. subject.base contains 'payapp'

Inspects: body.current_thread.text, subject.base, type.inbound. Sensors: regex.icontains, strings.icontains.

Indicators matched (3)

FieldMatchValue
regex.icontainsregexPayApp\s?#\d+
regex.icontainsregex[a-z0-9\.\+\-]+@[a-z0-9\-]+\.
strings.icontainssubstringpayapp