detection.wiki

Detection rules › Sublime MQL

Headers: iOS/iPadOS mailer with invalid build number

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects emails claiming to be sent from an iOS or iPadOS device that contain an invalid build number.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesEvasion

Event coverage

Message attribute
headers (collection)
type

Rule body MQL

type.inbound
and regex.contains(headers.mailer, '(iPad|iPhone) Mail')
and not regex.contains(headers.mailer, '(iPad|iPhone) Mail \([0-9]{2}')

Detection logic

Scope: inbound message.

Detects emails claiming to be sent from an iOS or iPadOS device that contain an invalid build number.

  1. inbound message
  2. headers.mailer matches '(iPad|iPhone) Mail'
  3. not:
    • headers.mailer matches '(iPad|iPhone) Mail \\([0-9]{2}'

Inspects: headers.mailer, type.inbound. Sensors: regex.contains.

Indicators matched (2)

FieldMatchValue
regex.containsregex(iPad|iPhone) Mail
regex.containsregex(iPad|iPhone) Mail \([0-9]{2}