Detection rules › Sublime MQL
Invoicera infrastructure abuse
This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Free file host, Free subdomain host, Image as content, Social engineering |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.root_domain == "invoicera.com"
// suspicious recipient pattern
and (
length(recipients.to) == 0
or any(recipients.to, .email.domain.valid == false)
or length(recipients.bcc) > 0
)
// suspicious link
and (
any(body.links,
.href_url.domain.root_domain in $free_file_hosts
or .href_url.domain.domain in $free_file_hosts
)
or any(body.links,
.href_url.domain.root_domain in $free_subdomain_hosts
and .href_url.domain.subdomain is not null
and .href_url.domain.subdomain != "www"
)
)
// mismatched reply-to
and (
headers.return_path.email is not null
and headers.return_path.email != sender.email.email
)
Detection logic
Scope: inbound message.
This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.
- inbound message
- sender.email.domain.root_domain is 'invoicera.com'
any of:
- length(recipients.to) is 0
any of
recipients.towhere:- .email.domain.valid is False
- length(recipients.bcc) > 0
any of:
any of
body.linkswhere any holds:- .href_url.domain.root_domain in $free_file_hosts
- .href_url.domain.domain in $free_file_hosts
any of
body.linkswhere all hold:- .href_url.domain.root_domain in $free_subdomain_hosts
- .href_url.domain.subdomain is set
- .href_url.domain.subdomain is not 'www'
all of:
- headers.return_path.email is set
- headers.return_path.email is not sender.email.email
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, headers.return_path.email, recipients.bcc, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $free_file_hosts, $free_subdomain_hosts.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | invoicera.com |