Detection rules › Sublime MQL
Link: RFI document reference pattern in display text
Detects links with display text containing RFI (Request for Information) document reference patterns using format RFI-###-###-###, commonly used in construction and procurement fraud schemes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
regex.icontains(.display_text, '\bRFI-\d{1,5}-\d{1,5}-\d{1,5}\b')
and not regex.icontains(.display_text,
'\bRFI-\d{2}-\d{2}-\d{4}\b',
'\bRFI-\d{4}-\d{2}-\d{2}\b'
)
)
and length(body.links) < 11
Detection logic
Scope: inbound message.
Detects links with display text containing RFI (Request for Information) document reference patterns using format RFI-###-###-###, commonly used in construction and procurement fraud schemes.
- inbound message
any of
body.current_thread.linkswhere all hold:- .display_text matches '\\bRFI-\\d{1,5}-\\d{1,5}-\\d{1,5}\\b'
not:
.display_text matches any of 2 patterns
\bRFI-\d{2}-\d{2}-\d{4}\b\bRFI-\d{4}-\d{2}-\d{2}\b
- length(body.links) < 11
Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.links, type.inbound. Sensors: regex.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \bRFI-\d{1,5}-\d{1,5}-\d{1,5}\b |
regex.icontains | regex | \bRFI-\d{2}-\d{2}-\d{4}\b |
regex.icontains | regex | \bRFI-\d{4}-\d{2}-\d{2}\b |