Detection rules › Sublime MQL
Impersonation: Employee using fabricated identity in initial contact
Detects inbound messages that appear to be initial contact attempts where the sender uses a display name that doesn't match their email address, includes basic greetings referencing the subject line, and signs off with their display name. The message is short with no attachments, suggesting a social engineering setup for further communication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: Employee, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers (collection) |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
// not a reply thread — this is initial contact
and length(headers.references) == 0
// short body, no attachments — initial contact social engineering
and length(body.current_thread.text) < 500
and length(attachments) == 0
// contains basic greeting
and any(["Hey", "Hi", "Hello"],
strings.starts_with(body.current_thread.text,
strings.concat(.,
" ",
regex.extract(subject.base,
'^\P{L}*([\p{L}''-]+)'
)[0].groups[0],
",\n"
)
)
)
// ends with the senders display name
and strings.ends_with(body.current_thread.text,
strings.concat("\n", sender.display_name, ".")
)
// sender display name not in the actual email address local part
and any(regex.iextract(sender.display_name, '\w+'),
.full_match not in~ (sender.email.local_part)
)
Detection logic
Scope: inbound message.
Detects inbound messages that appear to be initial contact attempts where the sender uses a display name that doesn't match their email address, includes basic greetings referencing the subject line, and signs off with their display name. The message is short with no attachments, suggesting a social engineering setup for further communication.
- inbound message
- length(headers.references) is 0
- length(body.current_thread.text) < 500
- length(attachments) is 0
any of
['Hey', 'Hi', 'Hello']where:- strings.starts_with(body.current_thread.text)
- strings.ends_with(body.current_thread.text)
any of
regex.iextract(sender.display_name)where:- .full_match not in (sender.email.local_part)
Inspects: body.current_thread.text, headers.references, sender.display_name, sender.email.local_part, subject.base, type.inbound. Sensors: regex.extract, regex.iextract, strings.concat, strings.ends_with, strings.starts_with.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.extract | regex | ^\P{L}*([\p{L}'-]+) |
regex.iextract | regex | \w+ |