Detection rules › Sublime MQL
Link: BEC with newly registered domains and financial keywords
Detects Business Email Compromise attacks containing links to newly registered domains (less than 60 days old) with invoice-related language and engaging action words. The message includes financial or payment terminology and prompts the recipient to take action through suspicious links. Uses natural language processing to identify credential theft or BEC intent while filtering out benign communications.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Evasion, Spoofing |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and 0 < length(body.current_thread.links) < 15
and any(body.current_thread.links,
network.whois(.href_url.domain).days_old < 60
and regex.icontains(.display_text,
'(?:view|click|download|check|validate)'
)
)
and regex.icontains(subject.base,
'\b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\b'
)
and regex.icontains(body.current_thread.text,
'\bwire\b',
'payment',
'invoice',
'\bACH\b',
'kindly',
'document',
'urgent',
'confirm'
)
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft", "bec") and .confidence != "low"
)
or any(ml.nlu_classifier(body.current_thread.text).tags,
.name in ("invoice", "payment")
)
)
// prevent benign emails
and not any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "benign"
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects Business Email Compromise attacks containing links to newly registered domains (less than 60 days old) with invoice-related language and engaging action words. The message includes financial or payment terminology and prompts the recipient to take action through suspicious links. Uses natural language processing to identify credential theft or BEC intent while filtering out benign communications.
- inbound message
all of:
- length(body.current_thread.links) > 0
- length(body.current_thread.links) < 15
any of
body.current_thread.linkswhere all hold:- network.whois(.href_url.domain).days_old < 60
- .display_text matches '(?:view|click|download|check|validate)'
- subject.base matches '\\b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\\b'
body.current_thread.text matches any of 8 patterns
\bwire\bpaymentinvoice\bACH\bkindlydocumenturgentconfirm
any of:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('cred_theft', 'bec')
- .confidence is not 'low'
any of
ml.nlu_classifier(body.current_thread.text).tagswhere:- .name in ('invoice', 'payment')
not:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name is 'benign'
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.current_thread.links[].href_url.domain, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: ml.nlu_classifier, network.whois, regex.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (15)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | (?:view|click|download|check|validate) |
regex.icontains | regex | \b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\b |
regex.icontains | regex | \bwire\b |
regex.icontains | regex | payment |
regex.icontains | regex | invoice |
regex.icontains | regex | \bACH\b |
regex.icontains | regex | kindly |
regex.icontains | regex | document |
regex.icontains | regex | urgent |
regex.icontains | regex | confirm |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | bec |
3 more
ml.nlu_classifier(body.current_thread.text).tags[].name | member | invoice |
ml.nlu_classifier(body.current_thread.text).tags[].name | member | payment |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | benign |