detection.wiki

Detection rules › Sublime MQL

PHP Mailer with common phishing attachments

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Mail coming from a PHP Mailer user agent that includes attachments with commonly used names in phishing campaigns

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImage as content

Event coverage

Message attribute
attachments (collection)
headers (collection)
type

Rule body MQL

type.inbound
and strings.ilike(headers.mailer, '*phpmailer*')
and any(attachments, .file_name in~ ('image.png', 'name.png', 'use.png'))

Detection logic

Scope: inbound message.

Mail coming from a PHP Mailer user agent that includes attachments with commonly used names in phishing campaigns

  1. inbound message
  2. headers.mailer matches '*phpmailer*'
  3. any of attachments where:
    • .file_name in ('image.png', 'name.png', 'use.png')

Inspects: attachments[].file_name, headers.mailer, type.inbound. Sensors: strings.ilike.

Indicators matched (4)

FieldMatchValue
strings.ilikesubstring*phpmailer*
attachments[].file_namememberimage.png
attachments[].file_namemembername.png
attachments[].file_namememberuse.png