detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: fuzzy

RuleSeverity
Fuzzy Attack Score: Advanced Graymail Detectionmedium

Fuzzy Attack Score: Advanced Graymail Detection

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Exercises the beta.fuzzy_attack_score() function. Flags on Graymail verdicts.

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • type

Rule body

type.inbound
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and beta.fuzzy_attack_score().verdict == "graymail"

Detection logic

Scope: inbound message.

Exercises the beta.fuzzy_attack_score() function. Flags on Graymail verdicts.

  1. inbound message
  2. beta.fuzzy_attack_score().verdict is 'graymail'

Inspects: type.inbound. Sensors: beta.fuzzy_attack_score.

Stages and Predicates

Stage 1: mql_rule

and
  beta.fuzzy_attack_score func_call "beta.fuzzy_attack_score().verdict == graymail"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"