Detection rules › Sublime MQL
Link: Invoice or receipt from freemail sender with customer service number
An email from a freemail sender which instructs the recipient to call a fraudulent customer service number.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Callback Phishing |
| Tactics and techniques | Free email provider, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain in $free_email_providers
and any(body.links,
.display_text == "Unsubscribe"
and (
length(.href_url.query_params) == 0 or .href_url.query_params is null
)
and (
.href_url.path == "/"
or .href_url.path is null
or (
.href_url.domain.root_domain == "google.com"
and not strings.ilike(.href_url.path, "*/forms/*")
)
)
)
and sender.email.email not in $sender_emails
Detection logic
Scope: inbound message.
An email from a freemail sender which instructs the recipient to call a fraudulent customer service number.
- inbound message
- sender.email.domain.root_domain in $free_email_providers
any of
body.linkswhere all hold:- .display_text is 'Unsubscribe'
any of:
- length(.href_url.query_params) is 0
- .href_url.query_params is missing
any of:
- .href_url.path is '/'
- .href_url.path is missing
all of:
- .href_url.domain.root_domain is 'google.com'
not:
- .href_url.path matches '*/forms/*'
- sender.email.email not in $sender_emails
Inspects: body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: strings.ilike. Reference lists: $free_email_providers, $sender_emails.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.links[].display_text | equals | Unsubscribe |
body.links[].href_url.path | equals | / |
body.links[].href_url.domain.root_domain | equals | google.com |
strings.ilike | substring | */forms/* |