Detection rules › Sublime MQL
AnonymousFox indicators
Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing, Malware/Ransomware |
Event coverage
| Message attribute |
|---|
| headers (collection) |
| headers.hops (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(headers.hops,
any(.fields,
regex.icontains(.name, "X-Authenticated-Sender|X-Sender")
and regex.icontains(.value, "(anonymous|smtp)fox-")
)
or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")
)
Detection logic
Scope: inbound message.
Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.
- inbound message
any of
headers.hopswhere any holds:any of
.fieldswhere all hold:- .name matches 'X-Authenticated-Sender|X-Sender'
- .value matches '(anonymous|smtp)fox-'
- sender.email.email matches '(anonymous|smtp)fox-'
Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, sender.email.email, type.inbound. Sensors: regex.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | X-Authenticated-Sender|X-Sender |
regex.icontains | regex | (anonymous|smtp)fox- |