Detection rules › Sublime MQL

DLP: Australia Credit Card Number

Severity
high
Type
dlp
Source
github.com/sublime-security/sublime-rules

Detects messages containing credit card numbers.

Event coverage

Rule body MQL

type.outbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_extension in~ ('.csv', '.txt', '.xlsx', '.xls')
        )
        and any(file.explode(.),
                // Credit card: 13-19 digits with optional spaces/hyphens
                regex.contains(.scan.ocr.raw, '\b(?:\d{4}[\s\-]?){3}\d{1,7}\b')
        )
)

Detection logic

Scope: outbound message.

Detects messages containing credit card numbers.

  1. outbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in $file_extensions_common_archives
      • .file_extension in ('.csv', '.txt', '.xlsx', '.xls')
    • any of file.explode(.) where:
      • .scan.ocr.raw matches '\\b(?:\\d{4}[\\s\\-]?){3}\\d{1,7}\\b'

Inspects: attachments[].file_extension, type.outbound. Sensors: file.explode, regex.contains. Reference lists: $file_extensions_common_archives.

Indicators matched (5)

FieldMatchValue
attachments[].file_extensionmember.csv
attachments[].file_extensionmember.txt
attachments[].file_extensionmember.xlsx
attachments[].file_extensionmember.xls
regex.containsregex\b(?:\d{4}[\s\-]?){3}\d{1,7}\b