Detection rules › Sublime MQL
Link: Remittance payment request with timeline template
Detects messages containing references to business days and account information with links containing 'remittance' in the URL path, commonly used in financial fraud schemes. This rule is looking at a specific template we're seeing in use with a expedited timeline.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| body.plain |
| type |
Rule body MQL
type.inbound
and strings.icontains(body.plain.raw, "business days")
and strings.icontains(body.plain.raw, "account")
and any(filter(body.links,
.href_url.domain.root_domain not in $tranco_10k
or (
.href_url.domain.root_domain in $tranco_10k
and (
.href_url.domain.domain in $self_service_creation_platform_domains
or .href_url.domain.root_domain in $self_service_creation_platform_domains
or .href_url.domain.root_domain in $free_file_hosts
or .href_url.domain.domain in $free_file_hosts
)
)
),
strings.icontains(.href_url.path, "remittance")
)
Detection logic
Scope: inbound message.
Detects messages containing references to business days and account information with links containing 'remittance' in the URL path, commonly used in financial fraud schemes. This rule is looking at a specific template we're seeing in use with a expedited timeline.
- inbound message
- body.plain.raw contains 'business days'
- body.plain.raw contains 'account'
any of
filter(body.links)where:- .href_url.path contains 'remittance'
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.plain.raw, type.inbound. Sensors: strings.icontains. Reference lists: $free_file_hosts, $self_service_creation_platform_domains, $tranco_10k.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | business days |
strings.icontains | substring | account |
strings.icontains | substring | remittance |