Detection rules › Sublime MQL

Sublime MQL rules: disposable

Rule	Severity
Disposable sender email (unsolicited)	`low`

Disposable sender email (unsolicited)

Severity: low
Type: rule
Source: github.com/sublime-security/sublime-rules

Sender is using a disposable email service and no one in our organization has ever sent them an email.

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain in $disposable_email_providers
and sender.email.email not in $recipient_emails

Detection logic

Scope: inbound message.

Sender is using a disposable email service and no one in our organization has ever sent them an email.

inbound message
sender.email.domain.root_domain in $disposable_email_providers
sender.email.email not in $recipient_emails

Inspects: sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $disposable_email_providers, $recipient_emails.

Stages and Predicates

Stage 1: `mql_rule`

and
  type.inbound eq "true"
   macro "sender.email.domain.root_domain in disposable_email_providers"
   macro "sender.email.email not in recipient_emails"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`