Detection rules › Sublime MQL
Attachment: Cold outreach with invitation subject and not attachment
Detects inbound messages with invitation-related subjects that request recipients to view attachments, contain no links, and are classified as B2B cold outreach with high confidence. Messages either have no attachments or contain a single image attachment.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Social engineering, Image as content |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body |
| body.current_thread |
| subject |
| type |
Rule body MQL
type.inbound
and strings.icontains(subject.subject, 'invit')
and length(body.links) == 0
// please find attached language
and regex.icontains(body.current_thread.text,
'(?:please|find|view).{0,50}attached'
)
// a single image attachment or there are 0 attachments
and (
(
length(attachments) == 1
and all(attachments, .file_type in $file_types_images)
)
or length(attachments) == 0
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "B2B Cold Outreach" and .confidence == "high"
)
Detection logic
Scope: inbound message.
Detects inbound messages with invitation-related subjects that request recipients to view attachments, contain no links, and are classified as B2B cold outreach with high confidence. Messages either have no attachments or contain a single image attachment.
- inbound message
- subject.subject contains 'invit'
- length(body.links) is 0
- body.current_thread.text matches '(?:please|find|view).{0,50}attached'
any of:
all of:
- length(attachments) is 1
all of
attachmentswhere:- .file_type in $file_types_images
- length(attachments) is 0
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'B2B Cold Outreach'
- .confidence is 'high'
Inspects: attachments[].file_type, body.current_thread.text, body.links, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $file_types_images.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | invit |
regex.icontains | regex | (?:please|find|view).{0,50}attached |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | B2B Cold Outreach |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |