Detection rules › Sublime MQL
Link: Self-sender credential theft with configuration placeholder
Detects messages where the sender and recipient are the same address, containing credential theft language and links with configuration placeholder text indicating a phishing lure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
// self sender
and length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
and any(body.current_thread.links,
strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
'/*──── CONFIG: Replace with your lure URL ────*/'
)
)
Detection logic
Scope: inbound message.
Detects messages where the sender and recipient are the same address, containing credential theft language and links with configuration placeholder text indicating a phishing lure.
- inbound message
- length(recipients.to) is 1
- sender.email.email is recipients.to[0].email.email
any of
body.current_thread.linkswhere:- ml.link_analysis(., mode='aggressive').final_dom.raw contains '/*──── CONFIG: Replace with your lure URL ────*/'
Inspects: body.current_thread.links, recipients.to, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: ml.link_analysis, strings.contains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | /*──── CONFIG: Replace with your lure URL ────*/ |