Detection rules › Sublime MQL

Link: RFI document reference pattern in display text

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links with display text containing RFI (Request for Information) document reference patterns using format RFI-###-###-###, commonly used in construction and procurement fraud schemes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesSocial engineering

Event coverage

Rule body MQL

type.inbound
and any(body.current_thread.links,
        regex.icontains(.display_text, '\bRFI-\d{1,5}-\d{1,5}-\d{1,5}\b')
        and not regex.icontains(.display_text,
                                '\bRFI-\d{2}-\d{2}-\d{4}\b',
                                '\bRFI-\d{4}-\d{2}-\d{2}\b'
        )
)
and length(body.links) < 11

Detection logic

Scope: inbound message.

Detects links with display text containing RFI (Request for Information) document reference patterns using format RFI-###-###-###, commonly used in construction and procurement fraud schemes.

  1. inbound message
  2. any of body.current_thread.links where all hold:
    • .display_text matches '\\bRFI-\\d{1,5}-\\d{1,5}-\\d{1,5}\\b'
    • not:
      • .display_text matches any of 2 patterns
        • \bRFI-\d{2}-\d{2}-\d{4}\b
        • \bRFI-\d{4}-\d{2}-\d{2}\b
  3. length(body.links) < 11

Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.links, type.inbound. Sensors: regex.icontains.

Indicators matched (3)

FieldMatchValue
regex.icontainsregex\bRFI-\d{1,5}-\d{1,5}-\d{1,5}\b
regex.icontainsregex\bRFI-\d{2}-\d{2}-\d{4}\b
regex.icontainsregex\bRFI-\d{4}-\d{2}-\d{2}\b