Detection rules › Sublime MQL

Sublime MQL rules: free

Rule	Severity
Link: Free file host link with 'Important Viewing Note' lure	`medium`
Mismatched links: Free file share with urgent language	`medium`

Link: Free file host link with 'Important Viewing Note' lure

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Free file host, Social engineering, Impersonation: Brand

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
type

Rule body

type.inbound
and any(body.current_thread.links, .href_url.domain.domain in $free_file_hosts)
and strings.icontains(body.current_thread.text, 'important viewing note')

Detection logic

Scope: inbound message.

inbound message
any of body.current_thread.links where:
- .href_url.domain.domain in $free_file_hosts
body.current_thread.text contains 'important viewing note'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.text, type.inbound. Sensors: strings.icontains. Reference lists: $free_file_hosts.

Indicators matched (1)

Field	Match	Value
`strings.icontains`	substring	`important viewing note`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(body.current_thread.links)
     macro "body.current_thread.links[].href_url.domain.domain in free_file_hosts"
  body.current_thread.text contains "important viewing note"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	contains	`important viewing note`	`field:"body.current_thread.text" kind:contains value:"important viewing note"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Mismatched links: Free file share with urgent language

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud, Callback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam
Tactics and techniques	Free file host, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.links
subject
type

Rule body

type.inbound

// Unsolicited + new sender
and (
  profile.by_sender_email().prevalence in ("new", "outlier")
  and not profile.by_sender_email().solicited
)
and not profile.by_sender_email().any_messages_benign

// Free file share
and any(body.links, .href_url.domain.domain in $free_file_hosts)

// urgent language
and 3 of (
  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency"),
  any(ml.nlu_classifier(subject.subject).entities, .name == "urgency"),
  regex.icontains(body.current_thread.text,
                  'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
  ),
  regex.icontains(subject.subject,
                  'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
  ),
  regex.icontains(body.current_thread.text,
                  'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
  )
)

// Mismatched link
and any(body.links,
        .mismatched == true
        and length(body.links) <= 3
        and not .href_url.domain.root_domain in (
          "mimecast.com",
          "mimecastprotect.com"
        )
)

Detection logic

Scope: inbound message.

Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.

inbound message
all of:
- profile.by_sender_email().prevalence in ('new', 'outlier')
- not:
  - profile.by_sender_email().solicited
not:
- profile.by_sender_email().any_messages_benign
any of body.links where:
- .href_url.domain.domain in $free_file_hosts
at least 3 of:
- any of ml.nlu_classifier(body.current_thread.text).entities where:
  - .name is 'urgency'
- any of ml.nlu_classifier(subject.subject).entities where:
  - .name is 'urgency'
- body.current_thread.text matches 'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
- subject.subject matches 'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
- body.current_thread.text matches 'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
any of body.links where all hold:
- .mismatched is True
- length(body.links) ≤ 3
- not:
  - .href_url.domain.root_domain in ('mimecast.com', 'mimecastprotect.com')

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].mismatched, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, regex.icontains. Reference lists: $free_file_hosts.

Indicators matched (5)

Field	Match	Value
`ml.nlu_classifier(body.current_thread.text).entities[].name`	equals	`urgency`
`ml.nlu_classifier(subject.subject).entities[].name`	equals	`urgency`
`regex.icontains`	regex	`immediate\|urgent\|expire\|suspend\|action.{0,20}required\|time.{0,10}sensitive\|verify.{0,20}immediately\|complete.{0,20}requested`
`regex.icontains`	regex	`immediate\|urgent\|expire\|suspend\|action.{0,20}required\|important.{0,20}announcement`
`regex.icontains`	regex	`deadline\|expires?.{0,10}(today\|soon)\|act.{0,10}now\|time.{0,10}running.{0,10}out\|limited.{0,10}time`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(body.links)
    and
      not
        body.links.href_url.domain.root_domain in ["mimecast.com", "mimecastprotect.com"]
      body.links length_compare "3"
      body.links.mismatched eq "true"
  or
    any(ml.nlu_classifier(body.current_thread.text).entities)
      ml.nlu_classifier(body.current_thread.text).entities.name eq "urgency"
    any(ml.nlu_classifier(subject.subject).entities)
      ml.nlu_classifier(subject.subject).entities.name eq "urgency"
    body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
    body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
    subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
  not
    profile.by_sender_email func_call "profile.by_sender_email().any_messages_benign"
  not
    profile.by_sender_email func_call "profile.by_sender_email().solicited"
  any(body.links)
     macro "body.links[].href_url.domain.domain in free_file_hosts"
  profile.by_sender_email func_call "profile.by_sender_email().prevalence in (new, outlier)"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`deadline` `expires?.{0,10}(today\|soon)` `act.{0,10}now` `time.{0,10}running.{0,10}out` `limited.{0,10}time` `immediate` `urgent` `expire` `suspend` `action.{0,20}required` `time.{0,10}sensitive` `verify.{0,20}immediately` `complete.{0,20}requested`	`field:"body.current_thread.text" kind:regex_match`
`subject.subject`	regex_match	`immediate` `urgent` `expire` `suspend` `action.{0,20}required` `important.{0,20}announcement`	`field:"subject.subject" kind:regex_match`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Sublime MQL rules: free

Link: Free file host link with 'Important Viewing Note' lure

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (1)

Stages and Predicates

Stage 1: mql_rule

Indicators

Mismatched links: Free file share with urgent language

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (5)

Stages and Predicates

Stage 1: mql_rule

Indicators

Stage 1: `mql_rule`

Stage 1: `mql_rule`