Sublime MQL rules: headers

Detection logic

Scope: inbound message.

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

1. inbound message
2. any of:

   • any of headers.hops where:

     • any of .fields where all hold:

       • .name starts with any of 2 patterns

         • X-Authenticated-Sender
         • X-Sender
       • .value matches '(anonymous|smtp)fox-'
   • sender.email.email matches '(anonymous|smtp)fox-'

Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, sender.email.email, type.inbound. Sensors: regex.icontains, strings.istarts_with.

Indicators matched (3)

Detection logic

Scope: inbound message.

Detects an unusual header mismatch where the sender is not a freemail address, but the reply-to or return-path are. NLU also detects a BEC intent with medium or high confidence.

1. inbound message
2. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:

   • .name in ('bec', 'advance_fee')
   • .confidence is 'high'
3. any of:

   • headers.return_path.domain.root_domain in $free_email_providers
   • all of:

     • length(headers.reply_to) > 0
     • all of headers.reply_to where:

       • .email.domain.root_domain in $free_email_providers
4. any of:

   • all of:

     • sender.email.domain.root_domain is 'paypal.com'
     • any of:

       • not:

         • headers.auth_summary.dmarc.pass
       • headers.auth_summary.dmarc.pass is missing
   • sender.email.domain.root_domain is missing
   • sender.email.domain.root_domain is not 'paypal.com'
5. sender.email.domain.root_domain not in $free_email_providers
6. any of:

   • headers.return_path.email is missing
   • not:

     • headers.return_path.local_part matches '*+caf_=*'
7. not:

   • all of:

     • any of headers.hops where:

       • any of .fields where:

         • .name is 'List-Unsubscribe'
     • sender.display_name contains 'via'
8. none of:

   • length(headers.references) > 0
   • headers.in_reply_to is set
9. not:

   • all of:

     • sender.email.email is 'quickbooks@notification.intuit.com'
     • headers.auth_summary.spf.pass
     • beta.profile.by_reply_to().prevalence in ('outlier', 'uncommon', 'rare', 'common')

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.in_reply_to, headers.references, headers.reply_to, headers.reply_to[].email.domain.root_domain, headers.return_path.domain.root_domain, headers.return_path.email, headers.return_path.local_part, sender.display_name, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: beta.profile.by_reply_to, ml.nlu_classifier, strings.contains, strings.ilike. Reference lists: $free_email_providers.

Indicators matched (4)

Detection logic

Scope: inbound message.

This rule detects unsolicited messages where the recipient matches the sender address and no other recipients are identified. The reply-to address does not match the sender, and is a freemail with no links in the body. This a common combination of techniques used by low level BEC threats.

1. inbound message
2. any of recipients.to where:

   • .email.email is sender.email.email
3. length(recipients.cc) is 0
4. length(recipients.bcc) is 0
5. length(body.links) is 0
6. any of headers.reply_to where all hold:

   • .email.domain.domain in $free_email_providers
   • not:

     • .email.domain.domain is sender.email.domain.domain
7. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign

Inspects: body.links, headers.reply_to, headers.reply_to[].email.domain.domain, recipients.bcc, recipients.cc, recipients.to, recipients.to[].email.email, sender.email.domain.domain, sender.email.email, type.inbound. Sensors: profile.by_sender. Reference lists: $free_email_providers.

Detection logic

Scope: inbound message.

Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.

1. inbound message
2. headers.in_reply_to is set
3. none of:

   • subject.is_forward
   • subject.is_reply
4. length(body.previous_threads) is 0
5. strings.count(sender.email.local_part, '*') ≥ 2

Inspects: body.previous_threads, headers.in_reply_to, sender.email.local_part, subject.is_forward, subject.is_reply, type.inbound. Sensors: strings.count.

Detection logic

Scope: inbound message.

Message sent to an invalid recipient domain with a reply-to address that differs from the sender address, originating from a new sender.

1. inbound message
2. length(recipients.to) ≤ 1
3. all of recipients.to where:

   • .email.domain.valid is False
4. length(headers.reply_to) is 1
5. headers.reply_to[0].email.domain.root_domain is not sender.email.domain.root_domain
6. profile.by_sender_email().prevalence is 'new'

Inspects: headers.reply_to, headers.reply_to[0].email.domain.root_domain, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender_email.

Detection logic

Scope: inbound message.

Detects emails claiming to be sent from an iOS or iPadOS device that contain an invalid build number.

1. inbound message
2. headers.mailer matches '(iPad|iPhone) Mail'
3. not:

   • headers.mailer matches '(iPad|iPhone) Mail \\([0-9]{2}'

Inspects: headers.mailer, type.inbound. Sensors: regex.contains.

Indicators matched (1)

Detection logic

Scope: inbound message.

Detects emails claiming to be sent from Outlook Express, which is a legacy email client that is no longer supported or commonly used.

1. inbound message
2. headers.mailer contains 'Outlook Express'
3. not:

   • profile.by_sender_email().any_messages_benign

Inspects: headers.mailer, type.inbound. Sensors: profile.by_sender_email, strings.icontains.

Indicators matched (1)

Detection logic

Scope: inbound message.

Detects messages containing 'risky-recover-production' in the message ID header, which may indicate suspicious or malicious activity.

1. inbound message
2. headers.message_id contains 'risky-recover-production'

Inspects: headers.message_id, type.inbound. Sensors: strings.icontains.

Indicators matched (1)

Detection logic

Scope: inbound message.

Detects messages with an empty sender email address and a display name impersonating system accounts like mailer-daemon, postmaster, or administrator, but lacking legitimate bounce back content as determined by natural language processing.

1. inbound message
2. sender.email.email is ''
3. any of:

   • sender.display_name contains 'mailer-daemon'
   • sender.display_name contains 'postmaster'
4. none of:

   • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:

     • .name is 'Bounce Back and Delivery Failure Notifications'
     • .confidence is 'high'
   • subject.subject matches 'Undeliver(?:ed|able)'
   • subject.subject matches 'Mensagem não entregue'
   • subject.subject matches '系统退信'

Inspects: body.current_thread.text, sender.display_name, sender.email.email, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains.

Indicators matched (3)

Detection logic

Scope: inbound message.

Detects messages where the X-Source-Auth header value doesn't match the sender's email address and the reply-to domain differs from the sender's domain, indicating potential sender spoofing or impersonation.

1. inbound message
2. any of headers.hops where:

   • any of .fields where all hold:

     • .name is 'X-Source-Auth'
     • .value is not sender.email.email
     • strings.parse_email(.value).email is set
3. length(headers.reply_to) > 0
4. all of headers.reply_to where:

   • .email.domain.root_domain is not sender.email.domain.root_domain
5. length(ml.nlu_classifier(body.current_thread.text).intents) > 0
6. not:

   • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:

     • .name is 'benign'
     • .confidence is not 'low'

Inspects: body.current_thread.text, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.reply_to, headers.reply_to[].email.domain.root_domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, strings.parse_email.

Indicators matched (1)

Detection logic

Scope: inbound message.

Detects Zimbra originated emails sent from non-supported Windows versions. Observed in widespread HTML credential phishing campaigns.

1. inbound message
2. headers.mailer starts with 'Zimbra'
3. headers.mailer matches '\\b(5\\.1|6\\.1)\\.\\d{4}\\b'

Inspects: headers.mailer, type.inbound. Sensors: regex.icontains, strings.starts_with.

Indicators matched (2)

Detection logic

Scope: inbound message.

Detects when a message comes through a distribution list by matching on return paths containing Sender Rewrite Scheme (SRS) from a previously unknown domain sender to a single recipient who has never interacted with the organization. This method has been observed being abused by threat actors to deliver callback phishing.

1. inbound message
2. length(recipients.to) is 1
3. length(recipients.bcc) is 0
4. sender.email.domain.root_domain in $tranco_50k
5. sender.email.domain.root_domain not in $free_email_providers
6. sender.email.domain.domain not in $free_email_providers
7. not:

   • any of recipients.to where:

     • .email.email is sender.email.email
8. any of:

   • headers.return_path.local_part contains '+SRS='
   • headers.auth_summary.spf.details.designator contains '+SRS='
   • any of headers.hops where:

     • .authentication_results.spf_details.designator contains '+SRS='
9. sender.email.domain.domain not in $org_domains
10. all of recipients.to where all hold:

    • .email.domain.domain not in $org_domains
    • any of:

      • all of:

        • .email.domain.domain not in $free_email_providers
        • .email.domain.root_domain not in $free_email_providers
        • .email.domain.domain not in $sender_domains
        • .email.domain.root_domain not in $sender_domains
        • .email.domain.domain not in $recipient_domains
        • .email.domain.root_domain not in $recipient_domains
      • all of:

        • any of:

          • .email.domain.domain in $free_email_providers
          • .email.domain.root_domain in $free_email_providers
        • .email.email not in $sender_emails
        • .email.email not in $recipient_emails
      • all of:

        • .email.domain.root_domain in ('onmicrosoft.com')
        • not:

          • .email.domain.domain in $org_domains
11. all of headers.reply_to where all hold:

    • .email.domain.domain not in $org_domains
    • .display_name not in $org_display_names
12. not:

    • strings.iends_with(headers.return_path.local_part)
13. not:

    • strings.icontains(headers.return_path.local_part)
14. not:

    • any of headers.hops where:

      • any of .fields where:

        • .name in ('X-MS-Exchange-ForwardingLoop', 'X-MS-Exchange-Inbox-Rules-Loop')

Inspects: headers.auth_summary.spf.details.designator, headers.hops, headers.hops[].authentication_results.spf_details.designator, headers.hops[].fields, headers.hops[].fields[].name, headers.reply_to, headers.reply_to[].display_name, headers.reply_to[].email.domain.domain, headers.return_path.local_part, mailbox.email.local_part, recipients.bcc, recipients.to, recipients.to[].email.domain.domain, recipients.to[].email.domain.root_domain, recipients.to[].email.email, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: strings.concat, strings.icontains, strings.iends_with. Reference lists: $free_email_providers, $org_display_names, $org_domains, $recipient_domains, $recipient_emails, $sender_domains, $sender_emails, $tranco_50k.

Indicators matched (2)

Detection logic

Scope: inbound message.

Mail coming from a PHP Mailer user agent that includes attachments with commonly used names in phishing campaigns

1. inbound message
2. headers.mailer matches '*phpmailer*'
3. any of attachments where:

   • .file_name in ('image.png', 'name.png', 'use.png')

Inspects: attachments[].file_name, headers.mailer, type.inbound. Sensors: strings.ilike.

Indicators matched (4)

Detection logic

Scope: inbound message.

The return-path header is a .ru TLD from an untrusted sender.

1. inbound message
2. headers.return_path.domain.tld is 'ru'
3. sender.email.domain.domain is not 'corp.mail.ru'
4. sender.email.domain.domain is not 'calendar.yandex.ru'
5. any of:

   • all of:

     • profile.by_sender().prevalence in ('new', 'outlier')
     • not:

       • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign
6. not:

   • profile.by_sender().any_messages_benign

Inspects: headers.return_path.domain.tld, sender.email.domain.domain, type.inbound. Sensors: profile.by_sender.

Indicators matched (1)

Detection logic

Scope: inbound message.

The message originates from an onmicrosoft.com email address being sent via Sendgrid.

1. inbound message
2. headers.return_path.domain.domain is 'sendgrid.net'
3. sender.email.domain.root_domain is 'onmicrosoft.com'
4. not:

   • sender.email.local_part matches any of 3 patterns

     • *postmaster*
     • *mailer-daemon*
     • *administrator*

Inspects: headers.return_path.domain.domain, sender.email.domain.root_domain, sender.email.local_part, type.inbound. Sensors: strings.like.

Indicators matched (2)

Detection logic

Scope: inbound message.

The message may contain a fake voicemail notification being sent via Sendgrid.

1. inbound message
2. headers.return_path.domain.domain is 'sendgrid.net'
3. any of:

   • strings.replace_confusables(subject.subject) matches any of 2 patterns

     • v[o0][il1]cema[il1][li1]
     • v[o0][il1]ce message
   • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:

     • .name is 'Voicemail Call and Missed Call Notifications'
     • .confidence is 'high'
4. any of ml.nlu_classifier(body.current_thread.text).intents where:

   • .name not in ('benign')

Inspects: body.current_thread.text, headers.return_path.domain.domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.replace_confusables.

Indicators matched (5)

Detection logic

Scope: inbound message.

Attackers can spoof domains that have no MX/SPF records, resulting in a DNS timeout. In O365 this fails closed (goes to spam), but in Gmail this fails open (lands in the inbox) and shows a red padlock Reproduce on Ubuntu 18.04: echo "test" | mail -s "Test" user@gmail.com -a"From: Support support@nomxdomain.com" Example headers: Received-SPF: temperror (google.com: error in processing during lookup of support@ltbit.com: DNS error) client-ip=<>; Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of support@nomxdomain.com: DNS error) smtp.mailfrom=support@nomxdomain.com

1. inbound message
2. any of headers.hops where:

   • any of .fields where all hold:

     • .name matches 'Received-SPF'
     • .value matches '*spf=temperror*'

Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, type.inbound. Sensors: strings.ilike.

Indicators matched (2)

Detection logic

Scope: inbound message.

Detects messages from a mismatched newly registered Reply-to domain that contain a financial or urgent request, or a request and an NLU tag with medium to high confidence, from an untrusted sender. This technique is typically observed in Vendor impersonation.

1. inbound message
2. length(body.current_thread.text) < 5000
3. any of:

   • any of headers.reply_to where all hold:

     • .email.domain.root_domain is not sender.email.domain.root_domain
     • network.whois(.email.domain).days_old ≤ 30
   • all of:

     • network.whois(sender.email.domain).days_old < 30
     • sender.email.domain.tld in $suspicious_tlds
4. any of ml.nlu_classifier(body.current_thread.text).entities where:

   • .name is 'request'
5. any of:

   • any of ml.nlu_classifier(body.current_thread.text).entities where:

     • .name in ('financial', 'urgency')
   • any of ml.nlu_classifier(body.current_thread.text).tags where all hold:

     • .name is set
     • .confidence in ('medium', 'high')
6. any of:

   • not:

     • profile.by_sender().solicited
   • not:

     • beta.profile.by_reply_to().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign
7. any of:

   • all of:

     • sender.email.domain.root_domain in $high_trust_sender_root_domains
     • not:

       • headers.auth_summary.dmarc.pass
   • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.reply_to, headers.reply_to[].email.domain, headers.reply_to[].email.domain.root_domain, sender.email.domain, sender.email.domain.root_domain, sender.email.domain.tld, type.inbound. Sensors: beta.profile.by_reply_to, ml.nlu_classifier, network.whois, profile.by_sender. Reference lists: $high_trust_sender_root_domains, $suspicious_tlds.

Indicators matched (5)