Detection rules › Sublime MQL
Fake message thread - Untrusted sender with a mismatched freemail reply-to address
Fake Message Threads or Chain Reuse is a common confidence technique exploited by threat actors to bolster credibility. This is typically used in conjunction with a reply-to address that is not the same as the sender address.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
(
profile.by_sender_email().prevalence in ("new", "outlier")
and not profile.by_sender().solicited
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
// Reply-to is a freemail sender but From is not
and any(headers.reply_to,
.email.domain.domain in $free_email_providers
and not .email.domain.domain == sender.email.domain.domain
)
// Exclude marketing emails
and not strings.ilike(sender.email.local_part,
"support",
"sales",
"noreply",
"marketing"
)
// Exclude mailing lists
and not any(headers.hops,
any(.fields,
.name in ("x-google-group-id", "list-post", "mailing-list")
)
)
// Check for Message Thread Indicators
and (
regex.icontains(subject.subject, '\b(?:RE|FWD?)\s*:')
or any([body.current_thread.text, body.html.display_text, body.plain.raw],
3 of (
strings.icontains(., "from:"),
strings.icontains(., "to:"),
strings.icontains(., "sent:"),
strings.icontains(., "date:"),
strings.icontains(., "cc:"),
strings.icontains(., "subject:")
)
)
)
// Check for the Presence of References or In-Reply-To properties
and (length(headers.references) == 0 or headers.in_reply_to is null)
Detection logic
Scope: inbound message.
Fake Message Threads or Chain Reuse is a common confidence technique exploited by threat actors to bolster credibility. This is typically used in conjunction with a reply-to address that is not the same as the sender address.
- inbound message
any of:
all of:
- profile.by_sender_email().prevalence in ('new', 'outlier')
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
any of
headers.reply_towhere all hold:- .email.domain.domain in $free_email_providers
not:
- .email.domain.domain is sender.email.domain.domain
not:
sender.email.local_part matches any of 4 patterns
supportsalesnoreplymarketing
not:
any of
headers.hopswhere:any of
.fieldswhere:- .name in ('x-google-group-id', 'list-post', 'mailing-list')
any of:
- subject.subject matches '\\b(?:RE|FWD?)\\s*:'
any of
[body.current_thread.text, body.html.display_text, body.plain.raw]where:at least 3 of 6: . contains any of 6 patterns
from:to:sent:date:cc:subject:
any of:
- length(headers.references) is 0
- headers.in_reply_to is missing
Inspects: body.current_thread.text, body.html.display_text, body.plain.raw, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.in_reply_to, headers.references, headers.reply_to, headers.reply_to[].email.domain.domain, sender.email.domain.domain, sender.email.local_part, subject.subject, type.inbound. Sensors: profile.by_sender, profile.by_sender_email, regex.icontains, strings.icontains, strings.ilike. Reference lists: $free_email_providers.
Indicators matched (14)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | support |
strings.ilike | substring | sales |
strings.ilike | substring | noreply |
strings.ilike | substring | marketing |
headers.hops[].fields[].name | member | x-google-group-id |
headers.hops[].fields[].name | member | list-post |
headers.hops[].fields[].name | member | mailing-list |
regex.icontains | regex | \b(?:RE|FWD?)\s*: |
strings.icontains | substring | from: |
strings.icontains | substring | to: |
strings.icontains | substring | sent: |
strings.icontains | substring | date: |
2 more
strings.icontains | substring | cc: |
strings.icontains | substring | subject: |