Detection rules › Sublime MQL
Hardbacon infrastructure abuse
Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| headers (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
and headers.mailer == 'Sendinblue'
and headers.auth_summary.dmarc.pass
and headers.auth_summary.spf.pass
Detection logic
Scope: inbound message.
Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.
- inbound message
- sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
- headers.mailer is 'Sendinblue'
- headers.auth_summary.dmarc.pass
- headers.auth_summary.spf.pass
Inspects: headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.mailer, sender.email.domain.root_domain, type.inbound.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | member | hardbacon.com |
sender.email.domain.root_domain | member | hardbacon.ca |
headers.mailer | equals | Sendinblue |