Detection rules › Sublime MQL

Sublime MQL rules: cold

Rule	Severity
Attachment: Cold outreach with invitation subject and not attachment	`high`

Attachment: Cold outreach with invitation subject and not attachment

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects inbound messages with invitation-related subjects that request recipients to view attachments, contain no links, and are classified as B2B cold outreach with high confidence. Messages either have no attachments or contain a single image attachment.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Spam
Tactics and techniques	Social engineering, Image as content

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
subject
type

Rule body

type.inbound
and strings.icontains(subject.subject, 'invit')
and length(body.links) == 0
// please find attached language
and regex.icontains(body.current_thread.text,
                    '(?:please|find|view).{0,50}attached'
)
// a single image attachment or there are 0 attachments
and (
  (
    length(attachments) == 1
    and all(attachments, .file_type in $file_types_images)
  )
  or length(attachments) == 0
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "B2B Cold Outreach" and .confidence == "high"
)

Detection logic

Scope: inbound message.

inbound message
subject.subject contains 'invit'
length(body.links) is 0
body.current_thread.text matches '(?:please|find|view).{0,50}attached'
any of:
- all of:
  - length(attachments) is 1
  - all of attachments where:
    
    .file_type in $file_types_images
- length(attachments) is 0
any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
- .name is 'B2B Cold Outreach'
- .confidence is 'high'

Inspects: attachments[].file_type, body.current_thread.text, body.links, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $file_types_images.

Indicators matched (4)

Field	Match	Value
`strings.icontains`	substring	`invit`
`regex.icontains`	regex	`(?:please\|find\|view).{0,50}attached`
`ml.nlu_classifier(body.current_thread.text).topics[].name`	equals	`B2B Cold Outreach`
`ml.nlu_classifier(body.current_thread.text).topics[].confidence`	equals	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      attachments length_compare "1"
       macro "all(attachments)"
    attachments length_compare "0"
  any(ml.nlu_classifier(body.current_thread.text).topics)
    and
      ml.nlu_classifier(body.current_thread.text).topics.confidence eq "high"
      ml.nlu_classifier(body.current_thread.text).topics.name eq "B2B Cold Outreach"
  body.current_thread.text regex_match "(?:please|find|view).{0,50}attached"
  body.links length_compare "0"
  subject.subject contains "invit"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`(?:please\|find\|view).{0,50}attached`	`field:"body.current_thread.text" kind:regex_match value:"(?:please\|find\|view).{0,50}attached"`
`subject.subject`	contains	`invit`	`field:"subject.subject" kind:contains value:"invit"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`