Detection rules › Sublime MQL
DLP: Australia Credit Card Number
Detects messages containing credit card numbers.
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.outbound
and any(attachments,
(
.file_extension in~ $file_extensions_common_archives
or .file_extension in~ ('.csv', '.txt', '.xlsx', '.xls')
)
and any(file.explode(.),
// Credit card: 13-19 digits with optional spaces/hyphens
regex.contains(.scan.ocr.raw, '\b(?:\d{4}[\s\-]?){3}\d{1,7}\b')
)
)
Detection logic
Scope: outbound message.
Detects messages containing credit card numbers.
- outbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_common_archives
- .file_extension in ('.csv', '.txt', '.xlsx', '.xls')
any of
file.explode(.)where:- .scan.ocr.raw matches '\\b(?:\\d{4}[\\s\\-]?){3}\\d{1,7}\\b'
Inspects: attachments[].file_extension, type.outbound. Sensors: file.explode, regex.contains. Reference lists: $file_extensions_common_archives.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | .csv |
attachments[].file_extension | member | .txt |
attachments[].file_extension | member | .xlsx |
attachments[].file_extension | member | .xls |
regex.contains | regex | \b(?:\d{4}[\s\-]?){3}\d{1,7}\b |