Detection rules › Sublime MQL
Link: Self-sent message with quarterly document review request
Detects messages sent from a user to themselves containing a link with quarterly indicators (q1_, q2_, q3_, q4_) and specific document review language requesting urgent feedback.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
// self sender
and length(recipients.to) == 1
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
)
// first link is not related to the sender via sld (to account for orgs that have multiple tlds)
and body.current_thread.links[0].href_url.domain.sld != sender.email.domain.sld
and regex.icontains(body.current_thread.links[0].display_text, 'q[1-4]_20')
Detection logic
Scope: inbound message.
Detects messages sent from a user to themselves containing a link with quarterly indicators (q1_, q2_, q3_, q4_) and specific document review language requesting urgent feedback.
- inbound message
- length(recipients.to) is 1
- length(recipients.cc) is 0
- length(recipients.bcc) is 0
any of:
- sender.email.email is recipients.to[0].email.email
- recipients.to[0].email.domain.valid is False
- body.current_thread.links[0].href_url.domain.sld is not sender.email.domain.sld
- body.current_thread.links[0].display_text matches 'q[1-4]_20'
Inspects: body.current_thread.links[0].display_text, body.current_thread.links[0].href_url.domain.sld, recipients.bcc, recipients.cc, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.domain.sld, sender.email.email, type.inbound. Sensors: regex.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | q[1-4]_20 |