Detection rules › Sublime MQL
Fake warning banner using confusable characters
Detects messages containing fake security banners that use visually similar characters to impersonate legitimate sender verification text, potentially to bypass security controls and deceive recipients.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and (
regex.contains(strings.replace_confusables(body.current_thread.text),
'This sender has been verified fro(?:m|rn) safe senders list'
)
or any(body.current_thread.banners,
regex.contains(strings.replace_confusables(.text),
'This sender has been verified fro(?:m|rn) safe senders list'
)
)
)
Detection logic
Scope: inbound message.
Detects messages containing fake security banners that use visually similar characters to impersonate legitimate sender verification text, potentially to bypass security controls and deceive recipients.
- inbound message
any of:
- strings.replace_confusables(body.current_thread.text) matches 'This sender has been verified fro(?:m|rn) safe senders list'
any of
body.current_thread.bannerswhere:- strings.replace_confusables(.text) matches 'This sender has been verified fro(?:m|rn) safe senders list'
Inspects: body.current_thread.banners, body.current_thread.banners[].text, body.current_thread.text, type.inbound. Sensors: regex.contains, strings.replace_confusables.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.contains | regex | This sender has been verified fro(?:m|rn) safe senders list |