Detection rules › Sublime MQL

Sublime MQL rules: generic

Rule	Severity
Generic service abuse from newly registered domain	`high`

Generic service abuse from newly registered domain

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages from services that write the true sender to the reply-to field, where the sender has no prior legitimate message history and is newly registered. Indicative of service abuse.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud, Callback Phishing, Credential Phishing
Tactics and techniques	Evasion, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

headers
headers.reply_to
sender.email
type

Rule body

type.inbound
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)
and sender.email.domain.domain in $replyto_service_domains
// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 
and not beta.profile.by_reply_to().solicited
and not beta.profile.by_reply_to().any_messages_benign

Detection logic

Scope: inbound message.

Detects messages from services that write the true sender to the reply-to field, where the sender has no prior legitimate message history and is newly registered. Indicative of service abuse.

inbound message
any of headers.reply_to where:
- network.whois(.email.domain).days_old < 30
sender.email.domain.domain in $replyto_service_domains
not:
- beta.profile.by_reply_to().solicited
not:
- beta.profile.by_reply_to().any_messages_benign

Inspects: headers.reply_to, headers.reply_to[].email.domain, sender.email.domain.domain, type.inbound. Sensors: beta.profile.by_reply_to, network.whois. Reference lists: $replyto_service_domains.

Stages and Predicates

Stage 1: `mql_rule`

and
  not
    beta.profile.by_reply_to func_call "beta.profile.by_reply_to().any_messages_benign"
  not
    beta.profile.by_reply_to func_call "beta.profile.by_reply_to().solicited"
  any(headers.reply_to)
    network.whois func_call "network.whois(headers.reply_to[].email.domain).days_old < 30"
  type.inbound eq "true"
   macro "sender.email.domain.domain in replyto_service_domains"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`