Detection rules › Sublime MQL
Sublime MQL rules: infra
| Rule | Severity |
|---|---|
| Hardbacon infrastructure abuse | high |
Hardbacon infrastructure abuse
#Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Impersonation: Brand, Social engineering |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message attributes
headersheaders.auth_summarysender.emailtype
Rule body
type.inbound
and sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
and headers.mailer == 'Sendinblue'
and headers.auth_summary.dmarc.pass
and headers.auth_summary.spf.pass
Detection logic
Scope: inbound message.
Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.
- inbound message
- sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
- headers.mailer is 'Sendinblue'
- headers.auth_summary.dmarc.pass
- headers.auth_summary.spf.pass
Inspects: headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.mailer, sender.email.domain.root_domain, type.inbound.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | member | hardbacon.com |
sender.email.domain.root_domain | member | hardbacon.ca |
headers.mailer | equals | Sendinblue |
Stages and Predicates
Stage 1: mql_rule
and
headers.auth_summary.dmarc.pass eq "true"
headers.auth_summary.spf.pass eq "true"
headers.mailer eq "Sendinblue"
sender.email.domain.root_domain in ["hardbacon.ca", "hardbacon.com"]
type.inbound eq "true"Indicators
These rows show field, operator, and value matches.