Detection rules › Sublime MQL

Link: Self-sent message with quarterly document review request

Severity
critical
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages sent from a user to themselves containing a link with quarterly indicators (q1_, q2_, q3_, q4_) and specific document review language requesting urgent feedback.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Rule body MQL

type.inbound
// self sender
and length(recipients.to) == 1
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
// first link is not related to the sender via sld (to account for orgs that have multiple tlds)
and body.current_thread.links[0].href_url.domain.sld != sender.email.domain.sld
and regex.icontains(body.current_thread.links[0].display_text, 'q[1-4]_20')

Detection logic

Scope: inbound message.

Detects messages sent from a user to themselves containing a link with quarterly indicators (q1_, q2_, q3_, q4_) and specific document review language requesting urgent feedback.

  1. inbound message
  2. length(recipients.to) is 1
  3. length(recipients.cc) is 0
  4. length(recipients.bcc) is 0
  5. any of:
    • sender.email.email is recipients.to[0].email.email
    • recipients.to[0].email.domain.valid is False
  6. body.current_thread.links[0].href_url.domain.sld is not sender.email.domain.sld
  7. body.current_thread.links[0].display_text matches 'q[1-4]_20'

Inspects: body.current_thread.links[0].display_text, body.current_thread.links[0].href_url.domain.sld, recipients.bcc, recipients.cc, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.domain.sld, sender.email.email, type.inbound. Sensors: regex.icontains.

Indicators matched (1)

FieldMatchValue
regex.icontainsregexq[1-4]_20