Detection rules › Sublime MQL
Headers: X-Source-Auth mismatch with mismatched reply-to domain
Detects messages where the X-Source-Auth header value doesn't match the sender's email address and the reply-to domain differs from the sender's domain, indicating potential sender spoofing or impersonation.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Spoofing |
Event coverage
Rule body MQL
type.inbound
// X-Source-Auth doesn't match sender
and any(headers.hops,
any(.fields,
.name == 'X-Source-Auth'
and .value != sender.email.email
and strings.parse_email(.value).email is not null
)
)
// mismatched sender (from) and Reply-to
and length(headers.reply_to) > 0
and all(headers.reply_to,
.email.domain.root_domain != sender.email.domain.root_domain
)
and length(ml.nlu_classifier(body.current_thread.text).intents) > 0
and not any(ml.nlu_classifier(body.current_thread.text).intents,
.name == 'benign' and .confidence != 'low'
)
Detection logic
Scope: inbound message.
Detects messages where the X-Source-Auth header value doesn't match the sender's email address and the reply-to domain differs from the sender's domain, indicating potential sender spoofing or impersonation.
- inbound message
any of
headers.hopswhere:any of
.fieldswhere all hold:- .name is 'X-Source-Auth'
- .value is not sender.email.email
- strings.parse_email(.value).email is set
- length(headers.reply_to) > 0
all of
headers.reply_towhere:- .email.domain.root_domain is not sender.email.domain.root_domain
- length(ml.nlu_classifier(body.current_thread.text).intents) > 0
not:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'benign'
- .confidence is not 'low'
Inspects: body.current_thread.text, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.reply_to, headers.reply_to[].email.domain.root_domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, strings.parse_email.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
headers.hops[].fields[].name | equals | X-Source-Auth |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | benign |