Detection rules › Sublime MQL
Headers: System account impersonation with empty sender address
Detects messages with an empty sender email address and a display name impersonating system accounts like mailer-daemon, postmaster, or administrator, but lacking legitimate bounce back content as determined by natural language processing.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Impersonation: Employee, Social engineering, Spoofing |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.email == ""
and (
strings.icontains(sender.display_name, "mailer-daemon")
or strings.icontains(sender.display_name, "postmaster")
)
and not (
(
any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Bounce Back and Delivery Failure Notifications"
and .confidence == "high"
)
or regex.icontains(subject.subject, 'Undeliver(?:ed|able)')
or regex.icontains(subject.subject,
'Mensagem não entregue'
) // portuguese bounce back variant
or regex.icontains(subject.subject,
'系统退信'
) // chinese bounce back variant
)
)
Detection logic
Scope: inbound message.
Detects messages with an empty sender email address and a display name impersonating system accounts like mailer-daemon, postmaster, or administrator, but lacking legitimate bounce back content as determined by natural language processing.
- inbound message
- sender.email.email is ''
any of:
- sender.display_name contains 'mailer-daemon'
- sender.display_name contains 'postmaster'
none of:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Bounce Back and Delivery Failure Notifications'
- .confidence is 'high'
- subject.subject matches 'Undeliver(?:ed|able)'
- subject.subject matches 'Mensagem não entregue'
- subject.subject matches '系统退信'
Inspects: body.current_thread.text, sender.display_name, sender.email.email, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | |
strings.icontains | substring | mailer-daemon |
strings.icontains | substring | postmaster |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Bounce Back and Delivery Failure Notifications |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |
regex.icontains | regex | Undeliver(?:ed|able) |
regex.icontains | regex | Mensagem não entregue |
regex.icontains | regex | 系统退信 |