Detection rules › Sublime MQL
Headers: Fake in-reply-to with wildcard sender and missing thread context
Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Evasion, Social engineering, Spoofing |
Event coverage
| Message attribute |
|---|
| body |
| headers (collection) |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and headers.in_reply_to is not null
and not (subject.is_forward or subject.is_reply)
and length(body.previous_threads) == 0
and strings.count(sender.email.local_part, "*") >= 2
Detection logic
Scope: inbound message.
Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.
- inbound message
- headers.in_reply_to is set
none of:
- subject.is_forward
- subject.is_reply
- length(body.previous_threads) is 0
- strings.count(sender.email.local_part, '*') ≥ 2
Inspects: body.previous_threads, headers.in_reply_to, sender.email.local_part, subject.is_forward, subject.is_reply, type.inbound. Sensors: strings.count.