Detection rules › Sublime MQL
Sublime MQL rules: header
| Rule | Severity |
|---|---|
| Message traversed multiple onmicrosoft.com tenants | medium |
| Targeting: Specific AOL address | medium |
Message traversed multiple onmicrosoft.com tenants
#This detection rule identifies messages that have traversed multiple distinct onmicrosoft.com tenants. This technique has been observed as an evasion tactic to distribute a single message across a list of targeted recipients.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Evasion, Free email provider, Free subdomain host |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message attributes
headersheaders.hopsheaders.return_pathrecipientsrecipients.totype
Rule body
type.inbound
and length(recipients.to) == 1
and all(recipients.to,
.email.domain.root_domain == "onmicrosoft.com"
and not .email.domain.domain in $org_domains
)
// the message has traversed two or more different "onmicrosoft.com" subdomains
and length(distinct(map(filter(headers.hops,
strings.icontains(.authentication_results.spf_details.designator,
'.onmicrosoft.com'
)
and not strings.contains(.authentication_results.spf_details.designator,
"@"
)
),
.authentication_results.spf_details.designator
),
.
)
) > 1
and all(recipients.to,
.email.domain.domain != headers.return_path.domain.domain
)
Detection logic
Scope: inbound message.
This detection rule identifies messages that have traversed multiple distinct onmicrosoft.com tenants. This technique has been observed as an evasion tactic to distribute a single message across a list of targeted recipients.
- inbound message
- length(recipients.to) is 1
all of
recipients.towhere all hold:- .email.domain.root_domain is 'onmicrosoft.com'
not:
- .email.domain.domain in $org_domains
- length(distinct(map(filter(headers.hops, strings.icontains(.authentication_results.spf_details.designator, '.onmicrosoft.com') and not strings.contains(.authentication_results.spf_details.designator, '@')), .authentication_results.spf_details.designator), .)) > 1
all of
recipients.towhere:- .email.domain.domain is not headers.return_path.domain.domain
Inspects: headers.hops, headers.hops[].authentication_results.spf_details.designator, headers.return_path.domain.domain, recipients.to, recipients.to[].email.domain.domain, recipients.to[].email.domain.root_domain, type.inbound. Sensors: strings.contains, strings.icontains. Reference lists: $org_domains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
recipients.to[].email.domain.root_domain | equals | onmicrosoft.com |
strings.icontains | substring | .onmicrosoft.com |
Stages and Predicates
Stage 1: mql_rule
and
distinct(map(filter(headers.hops, strings.icontains(.authentication_results.spf_details.designator, '.onmicrosoft.com') and not strings.contains(.authentication_results.spf_details.designator, '@')), .authentication_results.spf_details.designator), .) length_compare "1"
recipients.to length_compare "1"
type.inbound eq "true"
macro "all(recipients.to)"Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
type.inbound | eq |
| field:"type.inbound" kind:eq value:"true" |
Targeting: Specific AOL address
#Message targeting a specific AOL address (me@aol.com) with a single recipient.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Social engineering |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message attributes
recipientsrecipients.to[0]type
Rule body
type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.email == "me@aol.com"
Detection logic
Scope: inbound message.
Message targeting a specific AOL address (me@aol.com) with a single recipient.
- inbound message
- length(recipients.to) is 1
- recipients.to[0].email.email is 'me@aol.com'
Inspects: recipients.to, recipients.to[0].email.email, type.inbound.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
recipients.to[0].email.email | equals | me@aol.com |
Stages and Predicates
Stage 1: mql_rule
and
recipients.to length_compare "1"
recipients.to[0].email.email eq "me@aol.com"
type.inbound eq "true"Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
recipients.to[0].email.email | eq |
| field:"recipients.to[0].email.email" kind:eq value:"me@aol.com" |
type.inbound | eq |
| field:"type.inbound" kind:eq value:"true" |