Detection rules › Sublime MQL

AnonymousFox indicators

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware

Event coverage

Rule body MQL

type.inbound
and any(headers.hops,
        any(.fields,
            regex.icontains(.name, "X-Authenticated-Sender|X-Sender")
            and regex.icontains(.value, "(anonymous|smtp)fox-")
        )
        or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")
)

Detection logic

Scope: inbound message.

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

  1. inbound message
  2. any of headers.hops where any holds:
    • any of .fields where all hold:
      • .name matches 'X-Authenticated-Sender|X-Sender'
      • .value matches '(anonymous|smtp)fox-'
    • sender.email.email matches '(anonymous|smtp)fox-'

Inspects: headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, sender.email.email, type.inbound. Sensors: regex.icontains.

Indicators matched (2)

FieldMatchValue
regex.icontainsregexX-Authenticated-Sender|X-Sender
regex.icontainsregex(anonymous|smtp)fox-