Detection rules › Sublime MQL
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)
This rule detects unsolicited messages where the recipient matches the sender address and no other recipients are identified. The reply-to address does not match the sender, and is a freemail with no links in the body. This a common combination of techniques used by low level BEC threats.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Evasion, Free email provider |
Event coverage
Rule body MQL
type.inbound
and any(recipients.to, .email.email == sender.email.email)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and length(body.links) == 0
and any(headers.reply_to,
.email.domain.domain in $free_email_providers
and not .email.domain.domain == sender.email.domain.domain
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
This rule detects unsolicited messages where the recipient matches the sender address and no other recipients are identified. The reply-to address does not match the sender, and is a freemail with no links in the body. This a common combination of techniques used by low level BEC threats.
- inbound message
any of
recipients.towhere:- .email.email is sender.email.email
- length(recipients.cc) is 0
- length(recipients.bcc) is 0
- length(body.links) is 0
any of
headers.reply_towhere all hold:- .email.domain.domain in $free_email_providers
not:
- .email.domain.domain is sender.email.domain.domain
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, headers.reply_to, headers.reply_to[].email.domain.domain, recipients.bcc, recipients.cc, recipients.to, recipients.to[].email.email, sender.email.domain.domain, sender.email.email, type.inbound. Sensors: profile.by_sender. Reference lists: $free_email_providers.