Detection rules › Sublime MQL

Link: Self-sender credential theft with configuration placeholder

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages where the sender and recipient are the same address, containing credential theft language and links with configuration placeholder text indicating a phishing lure.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Rule body MQL

type.inbound
// self sender
and length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
and any(body.current_thread.links,
        strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                         '/*──── CONFIG: Replace with your lure URL ────*/'
        )
)

Detection logic

Scope: inbound message.

Detects messages where the sender and recipient are the same address, containing credential theft language and links with configuration placeholder text indicating a phishing lure.

  1. inbound message
  2. length(recipients.to) is 1
  3. sender.email.email is recipients.to[0].email.email
  4. any of body.current_thread.links where:
    • ml.link_analysis(., mode='aggressive').final_dom.raw contains '/*──── CONFIG: Replace with your lure URL ────*/'

Inspects: body.current_thread.links, recipients.to, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: ml.link_analysis, strings.contains.

Indicators matched (1)

FieldMatchValue
strings.containssubstring/*──── CONFIG: Replace with your lure URL ────*/