Detection rules › Sublime MQL
Message traversed multiple onmicrosoft.com tenants
This detection rule identifies messages that have traversed multiple distinct onmicrosoft.com tenants. This technique has been observed as an evasion tactic to distribute a single message across a list of targeted recipients.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Evasion, Free email provider, Free subdomain host |
Event coverage
Rule body MQL
type.inbound
and length(recipients.to) == 1
and all(recipients.to,
.email.domain.root_domain == "onmicrosoft.com"
and not .email.domain.domain in $org_domains
)
// the message has traversed two or more different "onmicrosoft.com" subdomains
and length(distinct(map(filter(headers.hops,
strings.icontains(.authentication_results.spf_details.designator,
'.onmicrosoft.com'
)
and not strings.contains(.authentication_results.spf_details.designator,
"@"
)
),
.authentication_results.spf_details.designator
),
.
)
) > 1
and all(recipients.to,
.email.domain.domain != headers.return_path.domain.domain
)
Detection logic
Scope: inbound message.
This detection rule identifies messages that have traversed multiple distinct onmicrosoft.com tenants. This technique has been observed as an evasion tactic to distribute a single message across a list of targeted recipients.
- inbound message
- length(recipients.to) is 1
all of
recipients.towhere all hold:- .email.domain.root_domain is 'onmicrosoft.com'
not:
- .email.domain.domain in $org_domains
- length(distinct(map(filter(headers.hops, strings.icontains(.authentication_results.spf_details.designator, '.onmicrosoft.com') and not strings.contains(.authentication_results.spf_details.designator, '@')), .authentication_results.spf_details.designator), .)) > 1
all of
recipients.towhere:- .email.domain.domain is not headers.return_path.domain.domain
Inspects: headers.hops, headers.hops[].authentication_results.spf_details.designator, headers.return_path.domain.domain, recipients.to, recipients.to[].email.domain.domain, recipients.to[].email.domain.root_domain, type.inbound. Sensors: strings.contains, strings.icontains. Reference lists: $org_domains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
recipients.to[].email.domain.root_domain | equals | onmicrosoft.com |
strings.icontains | substring | .onmicrosoft.com |
strings.contains | substring | @ |