Detection rules › Sublime MQL

DLP: Taiwan ID Number

Severity
high
Type
dlp
Source
github.com/sublime-security/sublime-rules

Detects messages containing Taiwan National Identification Card numbers.

Event coverage

Rule body MQL

type.outbound
and any([body.current_thread.text, subject.subject],
        // Taiwan ID: 1 letter + 9 digits
        regex.contains(., '\b[A-Z]\d{9}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'taiwan|national\s+ID|身分證')
)
and (
  strings.icontains(sender.email.domain.tld, "tw")
  or strings.icontains(body.current_thread.text, "taiwan")
)

Detection logic

Scope: outbound message.

Detects messages containing Taiwan National Identification Card numbers.

  1. outbound message
  2. any of [body.current_thread.text, subject.subject] where:
    • . matches '\\b[A-Z]\\d{9}\\b'
  3. any of [body.current_thread.text, subject.subject] where:
    • . matches 'taiwan|national\\s+ID|身分證'
  4. any of:
    • sender.email.domain.tld contains 'tw'
    • body.current_thread.text contains 'taiwan'

Inspects: body.current_thread.text, sender.email.domain.tld, subject.subject, type.outbound. Sensors: regex.contains, regex.icontains, strings.icontains.

Indicators matched (4)

FieldMatchValue
regex.containsregex\b[A-Z]\d{9}\b
regex.icontainsregextaiwan|national\s+ID|身分證
strings.icontainssubstringtw
strings.icontainssubstringtaiwan