Detection rules › Sublime MQL
Mass campaign: recipient address in subject, body, and link (untrusted sender)
This detects a pattern commonly observed in mass phishing campaigns. The local_part or the full email address of the recipient is used in the subject, body, and link query parameter to "personalize" the attack.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(recipients.to) + length(recipients.bcc) + length(recipients.cc) == 1
// exclude To: Undisclosed recipients:;
// since we won't have a valid recipient email
and any(recipients.to, .email.domain.valid == true)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and (
any(recipients.to,
(
strings.icontains(subject.subject, .email.email)
or strings.icontains(subject.subject, .email.local_part)
)
and (
.email.domain.valid or strings.icontains(.display_name, "undisclosed")
)
)
)
and any(recipients.to,
strings.icontains(body.current_thread.text, .email.email)
)
and any(body.links,
any(recipients.to,
strings.icontains(..href_url.query_params, .email.email)
)
and (
(
not strings.icontains(.display_text, "unsubscribe")
and not strings.icontains(.href_url.path, "unsubscribe")
)
)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft") and .confidence == "high"
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
This detects a pattern commonly observed in mass phishing campaigns. The local_part or the full email address of the recipient is used in the subject, body, and link query parameter to "personalize" the attack.
- inbound message
- length(recipients.to) + length(recipients.bcc) + length(recipients.cc) is 1
any of
recipients.towhere:- .email.domain.valid is True
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
any of
recipients.towhere all hold:any of:
- strings.icontains(subject.subject)
- strings.icontains(subject.subject)
any of:
- .email.domain.valid
- .display_name contains 'undisclosed'
any of
recipients.towhere:- strings.icontains(body.current_thread.text)
any of
body.linkswhere all hold:any of
recipients.towhere:- strings.icontains(.href_url.query_params)
all of:
not:
- .display_text contains 'unsubscribe'
not:
- .href_url.path contains 'unsubscribe'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('cred_theft')
- .confidence is 'high'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.path, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.valid, recipients.to[].email.email, recipients.to[].email.local_part, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | undisclosed |
strings.icontains | substring | unsubscribe |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |