Detection rules › Sublime MQL

Link: Remittance payment request with timeline template

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing references to business days and account information with links containing 'remittance' in the URL path, commonly used in financial fraud schemes. This rule is looking at a specific template we're seeing in use with a expedited timeline.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesSocial engineering

Event coverage

Rule body MQL

type.inbound
and strings.icontains(body.plain.raw, "business days")
and strings.icontains(body.plain.raw, "account")
and any(filter(body.links,
               .href_url.domain.root_domain not in $tranco_10k
               or (
                 .href_url.domain.root_domain in $tranco_10k
                 and (
                   .href_url.domain.domain in $self_service_creation_platform_domains
                   or .href_url.domain.root_domain in $self_service_creation_platform_domains
                   or .href_url.domain.root_domain in $free_file_hosts
                   or .href_url.domain.domain in $free_file_hosts
                 )
               )
        ),
        strings.icontains(.href_url.path, "remittance")
)

Detection logic

Scope: inbound message.

Detects messages containing references to business days and account information with links containing 'remittance' in the URL path, commonly used in financial fraud schemes. This rule is looking at a specific template we're seeing in use with a expedited timeline.

  1. inbound message
  2. body.plain.raw contains 'business days'
  3. body.plain.raw contains 'account'
  4. any of filter(body.links) where:
    • .href_url.path contains 'remittance'

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.plain.raw, type.inbound. Sensors: strings.icontains. Reference lists: $free_file_hosts, $self_service_creation_platform_domains, $tranco_10k.

Indicators matched (3)

FieldMatchValue
strings.icontainssubstringbusiness days
strings.icontainssubstringaccount
strings.icontainssubstringremittance