Detection rules › Sublime MQL
DLP: France Debit Card Number
Detects messages containing debit card numbers.
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.outbound
and any(attachments,
(
.file_extension in~ $file_extensions_common_archives
or .file_extension in~ ('.csv', '.txt', '.xlsx', '.xls')
)
and any(file.explode(.),
regex.contains(.scan.ocr.raw, '\b(?:\d{4}[\s\-]?){3}\d{1,7}\b')
)
)
and (
strings.icontains(sender.email.domain.tld, "fr")
or strings.icontains(body.current_thread.text, "france")
)
Detection logic
Scope: outbound message.
Detects messages containing debit card numbers.
- outbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_common_archives
- .file_extension in ('.csv', '.txt', '.xlsx', '.xls')
any of
file.explode(.)where:- .scan.ocr.raw matches '\\b(?:\\d{4}[\\s\\-]?){3}\\d{1,7}\\b'
any of:
- sender.email.domain.tld contains 'fr'
- body.current_thread.text contains 'france'
Inspects: attachments[].file_extension, body.current_thread.text, sender.email.domain.tld, type.outbound. Sensors: file.explode, regex.contains, strings.icontains. Reference lists: $file_extensions_common_archives.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | .csv |
attachments[].file_extension | member | .txt |
attachments[].file_extension | member | .xlsx |
attachments[].file_extension | member | .xls |
regex.contains | regex | \b(?:\d{4}[\s\-]?){3}\d{1,7}\b |
strings.icontains | substring | fr |
strings.icontains | substring | france |