detection.wiki

Detection rules › Sublime MQL

Headers: Outlook Express mailer

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects emails claiming to be sent from Outlook Express, which is a legacy email client that is no longer supported or commonly used.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Spoofing

Event coverage

Message attribute
headers (collection)
type

Rule body MQL

type.inbound
and strings.icontains(headers.mailer, 'Outlook Express')
and not profile.by_sender_email().any_messages_benign

Detection logic

Scope: inbound message.

Detects emails claiming to be sent from Outlook Express, which is a legacy email client that is no longer supported or commonly used.

  1. inbound message
  2. headers.mailer contains 'Outlook Express'
  3. not:
    • profile.by_sender_email().any_messages_benign

Inspects: headers.mailer, type.inbound. Sensors: profile.by_sender_email, strings.icontains.

Indicators matched (1)

FieldMatchValue
strings.icontainssubstringOutlook Express