Detection rules › Sublime MQL
Body: PayApp transaction reference pattern
Detects messages containing PayApp transaction reference numbers in a specific format (PayApp# followed by digits) in either the message body or subject line.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| subject |
| type |
Rule body MQL
type.inbound
and regex.icontains(body.current_thread.text, 'PayApp\s?#\d+')
and regex.icontains(body.current_thread.text, '[a-z0-9\.\+\-]+@[a-z0-9\-]+\.')
and strings.icontains(subject.base, "payapp")
Detection logic
Scope: inbound message.
Detects messages containing PayApp transaction reference numbers in a specific format (PayApp# followed by digits) in either the message body or subject line.
- inbound message
- body.current_thread.text matches 'PayApp\\s?#\\d+'
- body.current_thread.text matches '[a-z0-9\\.\\+\\-]+@[a-z0-9\\-]+\\.'
- subject.base contains 'payapp'
Inspects: body.current_thread.text, subject.base, type.inbound. Sensors: regex.icontains, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | PayApp\s?#\d+ |
regex.icontains | regex | [a-z0-9\.\+\-]+@[a-z0-9\-]+\. |
strings.icontains | substring | payapp |