detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: observed

RuleSeverity
Observed IOC: Mail transiting bulletproof host - SmartApemedium
Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Grouphigh
Observed IOC: Malicious sender domainshigh
Observed IOC: Malicious sender email addresseshigh
Observed IOC: Malicious sender root domainshigh

Observed IOC: Mail transiting bulletproof host - SmartApe

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • headers
  • headers.ips
  • type

Rule body

type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "5.188.60.0/24",
                   "5.188.166.0/24",
                   "31.177.108.0/22",
                   "77.91.89.0/24",
                   "91.219.148.0/22",
                   "94.198.50.0/23",
                   "94.198.52.0/22",
                   "109.238.92.0/23",
                   "152.89.216.0/22",
                   "178.255.126.0/23",
                   "185.9.144.0/22",
                   "185.130.248.0/22",
                   "185.217.128.0/24",
                   "188.127.224.0/20",
                   "188.127.240.0/22",
                   "188.127.244.0/23",
                   "188.127.248.0/22",
                   "188.127.253.0/24",
                   "188.127.254.0/23",
                   "209.142.100.0/24",
                   "213.171.16.0/21",
                   "217.21.53.0/24",
                   "2a06:dd00::/32",
                   "2a0b:2d80::/32",
                   "2a0e:fb42::/32",
                   "2a0f:6fc5:3e84::/48",
                   "2a0f:6fc5:a4ae::/48",
                   "2a0f:8447::/32"
        )
)

Detection logic

Scope: inbound message.

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

  1. inbound message
  2. any of headers.ips where:
    • beta.ip_in(.ip, '5.188.60.0/24', '5.188.166.0/24', '31.177.108.0/22', '77.91.89.0/24', '91.219.148.0/22', '94.198.50.0/23', '94.198.52.0/22', '109.238.92.0/23', '152.89.216.0/22', '178.255.126.0/23', '185.9.144.0/22', '185.130.248.0/22', '185.217.128.0/24', '188.127.224.0/20', '188.127.240.0/22', '188.127.244.0/23', '188.127.248.0/22', '188.127.253.0/24', '188.127.254.0/23', '209.142.100.0/24', '213.171.16.0/21', '217.21.53.0/24', '2a06:dd00::/32', '2a0b:2d80::/32', '2a0e:fb42::/32', '2a0f:6fc5:3e84::/48', '2a0f:6fc5:a4ae::/48', '2a0f:8447::/32')

Inspects: headers.ips, headers.ips[].ip, type.inbound. Sensors: beta.ip_in.

Stages and Predicates

Stage 1: mql_rule

and
  any(headers.ips)
    beta.ip_in func_call "beta.ip_in(headers.ips[].ip, \"5.188.60.0/24\", \"5.188.166.0/24\", \"31.177.108.0/22\", \"77.91.89.0/24\", \"91.219.148.0/22\", \"94.198.50.0/23\", \"94.198.52.0/22\", \"109.238.92.0/23\", \"152.89.216.0/22\", \"178.255.126.0/23\", \"185.9.144.0/22\", \"185.130.248.0/22\", \"185.217.128.0/24\", \"188.127.224.0/20\", \"188.127.240.0/22\", \"188.127.244.0/23\", \"188.127.248.0/22\", \"188.127.253.0/24\", \"188.127.254.0/23\", \"209.142.100.0/24\", \"213.171.16.0/21\", \"217.21.53.0/24\", \"2a06:dd00::/32\", \"2a0b:2d80::/32\", \"2a0e:fb42::/32\", \"2a0f:6fc5:3e84::/48\", \"2a0f:6fc5:a4ae::/48\", \"2a0f:8447::/32\")"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • headers
  • headers.ips
  • type

Rule body

type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "5.182.86.0/23",
                   "45.80.228.0/22",
                   "45.136.175.0/24",
                   "45.136.228.0/24",
                   "45.137.60.0/24",
                   "45.137.81.0/24",
                   "45.140.13.0/24",
                   "45.141.177.0/24",
                   "45.144.54.0/23",
                   "45.145.13.0/24",
                   "45.145.14.0/24",
                   "45.146.131.0/24",
                   "45.150.32.0/23",
                   "45.151.101.0/24",
                   "45.151.102.0/24",
                   "45.152.198.0/24",
                   "45.155.71.0/24",
                   "46.226.160.0/21",
                   "62.60.148.0/22",
                   "62.60.156.0/22",
                   "62.60.186.0/24",
                   "62.60.228.0/22",
                   "62.60.236.0/22",
                   "77.73.131.0/24",
                   "77.73.135.0/24",
                   "77.110.96.0/21",
                   "77.110.104.0/23",
                   "77.110.106.0/24",
                   "77.110.108.0/24",
                   "77.110.110.0/24",
                   "77.110.116.0/24",
                   "77.110.118.0/24",
                   "77.110.120.0/23",
                   "77.221.136.0/21",
                   "77.221.148.0/23",
                   "77.221.151.0/24",
                   "77.221.152.0/21",
                   "77.232.142.0/23",
                   "78.153.130.0/24",
                   "79.137.184.0/24",
                   "79.137.192.0/24",
                   "79.137.194.0/23",
                   "79.137.196.0/22",
                   "79.137.202.0/23",
                   "79.137.204.0/22",
                   "79.137.248.0/24",
                   "80.85.241.0/24",
                   "81.19.137.0/24",
                   "82.117.84.0/24",
                   "82.117.87.0/24",
                   "84.22.148.0/22",
                   "85.192.24.0/21",
                   "85.192.37.0/24",
                   "85.192.38.0/24",
                   "85.192.40.0/23",
                   "85.192.42.0/24",
                   "85.192.56.0/24",
                   "85.192.60.0/23",
                   "85.192.63.0/24",
                   "89.22.224.0/20",
                   "89.169.32.0/22",
                   "89.169.52.0/22",
                   "89.185.85.0/24",
                   "89.208.96.0/23",
                   "89.208.103.0/24",
                   "89.208.104.0/22",
                   "89.208.113.0/24",
                   "91.103.140.0/24",
                   "91.108.240.0/23",
                   "91.108.242.0/24",
                   "91.184.240.0/22",
                   "92.246.136.0/22",
                   "94.228.162.0/23",
                   "94.228.164.0/23",
                   "94.228.169.0/24",
                   "94.228.170.0/24",
                   "94.228.172.0/24",
                   "95.163.152.0/23",
                   "95.163.176.0/24",
                   "95.181.160.0/24",
                   "95.181.162.0/24",
                   "95.181.167.0/24",
                   "95.181.174.0/23",
                   "104.238.29.0/24",
                   "109.107.181.0/24",
                   "109.107.189.0/24",
                   "109.107.190.0/24",
                   "109.120.132.0/22",
                   "109.120.138.0/23",
                   "109.120.140.0/24",
                   "109.120.149.0/24",
                   "109.120.150.0/23",
                   "109.120.152.0/24",
                   "109.120.155.0/24",
                   "109.120.156.0/23",
                   "109.120.176.0/22",
                   "109.120.184.0/22",
                   "109.172.94.0/23",
                   "138.124.13.0/24",
                   "138.124.14.0/24",
                   "138.124.18.0/24",
                   "138.124.24.0/23",
                   "138.124.26.0/24",
                   "138.124.29.0/24",
                   "138.124.34.0/23",
                   "138.124.49.0/24",
                   "138.124.50.0/23",
                   "138.124.52.0/22",
                   "138.124.58.0/23",
                   "138.124.61.0/24",
                   "138.124.78.0/24",
                   "138.124.89.0/24",
                   "138.124.90.0/23",
                   "138.124.92.0/23",
                   "138.124.99.0/24",
                   "138.124.101.0/24",
                   "138.124.102.0/23",
                   "138.124.108.0/23",
                   "138.124.110.0/24",
                   "138.124.112.0/21",
                   "138.124.124.0/24",
                   "138.124.127.0/24",
                   "147.45.40.0/22",
                   "147.45.68.0/22",
                   "147.45.72.0/21",
                   "176.124.198.0/23",
                   "176.124.202.0/23",
                   "176.124.204.0/22",
                   "176.124.220.0/23",
                   "176.124.222.0/24",
                   "178.20.208.0/23",
                   "178.159.94.0/24",
                   "178.236.246.0/23",
                   "178.236.248.0/24",
                   "178.236.250.0/23",
                   "178.236.252.0/24",
                   "178.236.255.0/24",
                   "185.68.244.0/24",
                   "185.96.80.0/24",
                   "185.103.100.0/22",
                   "185.104.151.0/24",
                   "185.125.100.0/22",
                   "185.197.74.0/24",
                   "185.221.196.0/24",
                   "185.221.199.0/24",
                   "185.230.143.0/24",
                   "185.246.217.0/24",
                   "193.8.215.0/24",
                   "193.29.224.0/23",
                   "193.32.8.0/24",
                   "193.33.153.0/24",
                   "193.188.20.0/23",
                   "193.188.22.0/24",
                   "193.232.178.0/24",
                   "193.233.88.0/22",
                   "193.233.128.0/23",
                   "193.233.133.0/24",
                   "193.233.136.0/22",
                   "193.233.161.0/24",
                   "193.233.201.0/24",
                   "193.233.208.0/22",
                   "193.233.216.0/21",
                   "193.233.230.0/23",
                   "193.233.232.0/23",
                   "193.233.244.0/22",
                   "193.233.248.0/22",
                   "194.26.229.0/24",
                   "194.33.34.0/23",
                   "194.59.186.0/24",
                   "194.76.217.0/24",
                   "194.113.106.0/24",
                   "194.226.169.0/24",
                   "195.74.90.0/24",
                   "212.113.100.0/22",
                   "212.113.106.0/24",
                   "212.113.116.0/24",
                   "212.113.119.0/24",
                   "213.21.229.0/24",
                   "213.21.233.0/24",
                   "213.21.235.0/24",
                   "213.21.242.0/24",
                   "213.21.246.0/24",
                   "213.21.250.0/23",
                   "213.21.252.0/24",
                   "213.21.254.0/24",
                   "213.108.20.0/22",
                   "213.165.32.0/21",
                   "213.165.40.0/22",
                   "213.165.44.0/24",
                   "213.165.46.0/24",
                   "213.165.48.0/23",
                   "213.176.64.0/22",
                   "213.176.112.0/22",
                   "217.144.184.0/21",
                   "2a01:e5c0::/33",
                   "2a01:e5c0:8003::/48",
                   "2a01:e5c0:8004::/48",
                   "2a01:e5c0:8008::/48",
                   "2a0b:4140:1000::/36",
                   "2a0b:4140:2000::/35",
                   "2a0b:4140:4000::/34",
                   "2a0b:4140:9000::/36",
                   "2a0b:4140:a000::/35",
                   "2a0b:4140:c000::/34",
                   "2a0e:b107:2780::/46",
                   "2a0f:cdc6:2010::/44",
                   "2a0f:cdc6:2020::/44",
                   "2a0f:cdc6:5030::/44",
                   "2a11:fc80::/29",
                   "2a12:5940:1::/48",
                   "2a12:5940:1000::/36",
                   "2a12:5940:2000::/35",
                   "2a12:5940:4000::/34",
                   "2a12:5940:8000::/33",
                   "2a14:a084::/35",
                   "2a14:a084:2000::/36"
        )
)

Detection logic

Scope: inbound message.

Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).

  1. inbound message
  2. any of headers.ips where:
    • beta.ip_in(.ip, '5.182.86.0/23', '45.80.228.0/22', '45.136.175.0/24', '45.136.228.0/24', '45.137.60.0/24', '45.137.81.0/24', '45.140.13.0/24', '45.141.177.0/24', '45.144.54.0/23', '45.145.13.0/24', '45.145.14.0/24', '45.146.131.0/24', '45.150.32.0/23', '45.151.101.0/24', '45.151.102.0/24', '45.152.198.0/24', '45.155.71.0/24', '46.226.160.0/21', '62.60.148.0/22', '62.60.156.0/22', '62.60.186.0/24', '62.60.228.0/22', '62.60.236.0/22', '77.73.131.0/24', '77.73.135.0/24', '77.110.96.0/21', '77.110.104.0/23', '77.110.106.0/24', '77.110.108.0/24', '77.110.110.0/24', '77.110.116.0/24', '77.110.118.0/24', '77.110.120.0/23', '77.221.136.0/21', '77.221.148.0/23', '77.221.151.0/24', '77.221.152.0/21', '77.232.142.0/23', '78.153.130.0/24', '79.137.184.0/24', '79.137.192.0/24', '79.137.194.0/23', '79.137.196.0/22', '79.137.202.0/23', '79.137.204.0/22', '79.137.248.0/24', '80.85.241.0/24', '81.19.137.0/24', '82.117.84.0/24', '82.117.87.0/24', '84.22.148.0/22', '85.192.24.0/21', '85.192.37.0/24', '85.192.38.0/24', '85.192.40.0/23', '85.192.42.0/24', '85.192.56.0/24', '85.192.60.0/23', '85.192.63.0/24', '89.22.224.0/20', '89.169.32.0/22', '89.169.52.0/22', '89.185.85.0/24', '89.208.96.0/23', '89.208.103.0/24', '89.208.104.0/22', '89.208.113.0/24', '91.103.140.0/24', '91.108.240.0/23', '91.108.242.0/24', '91.184.240.0/22', '92.246.136.0/22', '94.228.162.0/23', '94.228.164.0/23', '94.228.169.0/24', '94.228.170.0/24', '94.228.172.0/24', '95.163.152.0/23', '95.163.176.0/24', '95.181.160.0/24', '95.181.162.0/24', '95.181.167.0/24', '95.181.174.0/23', '104.238.29.0/24', '109.107.181.0/24', '109.107.189.0/24', '109.107.190.0/24', '109.120.132.0/22', '109.120.138.0/23', '109.120.140.0/24', '109.120.149.0/24', '109.120.150.0/23', '109.120.152.0/24', '109.120.155.0/24', '109.120.156.0/23', '109.120.176.0/22', '109.120.184.0/22', '109.172.94.0/23', '138.124.13.0/24', '138.124.14.0/24', '138.124.18.0/24', '138.124.24.0/23', '138.124.26.0/24', '138.124.29.0/24', '138.124.34.0/23', '138.124.49.0/24', '138.124.50.0/23', '138.124.52.0/22', '138.124.58.0/23', '138.124.61.0/24', '138.124.78.0/24', '138.124.89.0/24', '138.124.90.0/23', '138.124.92.0/23', '138.124.99.0/24', '138.124.101.0/24', '138.124.102.0/23', '138.124.108.0/23', '138.124.110.0/24', '138.124.112.0/21', '138.124.124.0/24', '138.124.127.0/24', '147.45.40.0/22', '147.45.68.0/22', '147.45.72.0/21', '176.124.198.0/23', '176.124.202.0/23', '176.124.204.0/22', '176.124.220.0/23', '176.124.222.0/24', '178.20.208.0/23', '178.159.94.0/24', '178.236.246.0/23', '178.236.248.0/24', '178.236.250.0/23', '178.236.252.0/24', '178.236.255.0/24', '185.68.244.0/24', '185.96.80.0/24', '185.103.100.0/22', '185.104.151.0/24', '185.125.100.0/22', '185.197.74.0/24', '185.221.196.0/24', '185.221.199.0/24', '185.230.143.0/24', '185.246.217.0/24', '193.8.215.0/24', '193.29.224.0/23', '193.32.8.0/24', '193.33.153.0/24', '193.188.20.0/23', '193.188.22.0/24', '193.232.178.0/24', '193.233.88.0/22', '193.233.128.0/23', '193.233.133.0/24', '193.233.136.0/22', '193.233.161.0/24', '193.233.201.0/24', '193.233.208.0/22', '193.233.216.0/21', '193.233.230.0/23', '193.233.232.0/23', '193.233.244.0/22', '193.233.248.0/22', '194.26.229.0/24', '194.33.34.0/23', '194.59.186.0/24', '194.76.217.0/24', '194.113.106.0/24', '194.226.169.0/24', '195.74.90.0/24', '212.113.100.0/22', '212.113.106.0/24', '212.113.116.0/24', '212.113.119.0/24', '213.21.229.0/24', '213.21.233.0/24', '213.21.235.0/24', '213.21.242.0/24', '213.21.246.0/24', '213.21.250.0/23', '213.21.252.0/24', '213.21.254.0/24', '213.108.20.0/22', '213.165.32.0/21', '213.165.40.0/22', '213.165.44.0/24', '213.165.46.0/24', '213.165.48.0/23', '213.176.64.0/22', '213.176.112.0/22', '217.144.184.0/21', '2a01:e5c0::/33', '2a01:e5c0:8003::/48', '2a01:e5c0:8004::/48', '2a01:e5c0:8008::/48', '2a0b:4140:1000::/36', '2a0b:4140:2000::/35', '2a0b:4140:4000::/34', '2a0b:4140:9000::/36', '2a0b:4140:a000::/35', '2a0b:4140:c000::/34', '2a0e:b107:2780::/46', '2a0f:cdc6:2010::/44', '2a0f:cdc6:2020::/44', '2a0f:cdc6:5030::/44', '2a11:fc80::/29', '2a12:5940:1::/48', '2a12:5940:1000::/36', '2a12:5940:2000::/35', '2a12:5940:4000::/34', '2a12:5940:8000::/33', '2a14:a084::/35', '2a14:a084:2000::/36')

Inspects: headers.ips, headers.ips[].ip, type.inbound. Sensors: beta.ip_in.

Stages and Predicates

Stage 1: mql_rule

and
  any(headers.ips)
    beta.ip_in func_call "beta.ip_in(headers.ips[].ip, \"5.182.86.0/23\", \"45.80.228.0/22\", \"45.136.175.0/24\", \"45.136.228.0/24\", \"45.137.60.0/24\", \"45.137.81.0/24\", \"45.140.13.0/24\", \"45.141.177.0/24\", \"45.144.54.0/23\", \"45.145.13.0/24\", \"45.145.14.0/24\", \"45.146.131.0/24\", \"45.150.32.0/23\", \"45.151.101.0/24\", \"45.151.102.0/24\", \"45.152.198.0/24\", \"45.155.71.0/24\", \"46.226.160.0/21\", \"62.60.148.0/22\", \"62.60.156.0/22\", \"62.60.186.0/24\", \"62.60.228.0/22\", \"62.60.236.0/22\", \"77.73.131.0/24\", \"77.73.135.0/24\", \"77.110.96.0/21\", \"77.110.104.0/23\", \"77.110.106.0/24\", \"77.110.108.0/24\", \"77.110.110.0/24\", \"77.110.116.0/24\", \"77.110.118.0/24\", \"77.110.120.0/23\", \"77.221.136.0/21\", \"77.221.148.0/23\", \"77.221.151.0/24\", \"77.221.152.0/21\", \"77.232.142.0/23\", \"78.153.130.0/24\", \"79.137.184.0/24\", \"79.137.192.0/24\", \"79.137.194.0/23\", \"79.137.196.0/22\", \"79.137.202.0/23\", \"79.137.204.0/22\", \"79.137.248.0/24\", \"80.85.241.0/24\", \"81.19.137.0/24\", \"82.117.84.0/24\", \"82.117.87.0/24\", \"84.22.148.0/22\", \"85.192.24.0/21\", \"85.192.37.0/24\", \"85.192.38.0/24\", \"85.192.40.0/23\", \"85.192.42.0/24\", \"85.192.56.0/24\", \"85.192.60.0/23\", \"85.192.63.0/24\", \"89.22.224.0/20\", \"89.169.32.0/22\", \"89.169.52.0/22\", \"89.185.85.0/24\", \"89.208.96.0/23\", \"89.208.103.0/24\", \"89.208.104.0/22\", \"89.208.113.0/24\", \"91.103.140.0/24\", \"91.108.240.0/23\", \"91.108.242.0/24\", \"91.184.240.0/22\", \"92.246.136.0/22\", \"94.228.162.0/23\", \"94.228.164.0/23\", \"94.228.169.0/24\", \"94.228.170.0/24\", \"94.228.172.0/24\", \"95.163.152.0/23\", \"95.163.176.0/24\", \"95.181.160.0/24\", \"95.181.162.0/24\", \"95.181.167.0/24\", \"95.181.174.0/23\", \"104.238.29.0/24\", \"109.107.181.0/24\", \"109.107.189.0/24\", \"109.107.190.0/24\", \"109.120.132.0/22\", \"109.120.138.0/23\", \"109.120.140.0/24\", \"109.120.149.0/24\", \"109.120.150.0/23\", \"109.120.152.0/24\", \"109.120.155.0/24\", \"109.120.156.0/23\", \"109.120.176.0/22\", \"109.120.184.0/22\", \"109.172.94.0/23\", \"138.124.13.0/24\", \"138.124.14.0/24\", \"138.124.18.0/24\", \"138.124.24.0/23\", \"138.124.26.0/24\", \"138.124.29.0/24\", \"138.124.34.0/23\", \"138.124.49.0/24\", \"138.124.50.0/23\", \"138.124.52.0/22\", \"138.124.58.0/23\", \"138.124.61.0/24\", \"138.124.78.0/24\", \"138.124.89.0/24\", \"138.124.90.0/23\", \"138.124.92.0/23\", \"138.124.99.0/24\", \"138.124.101.0/24\", \"138.124.102.0/23\", \"138.124.108.0/23\", \"138.124.110.0/24\", \"138.124.112.0/21\", \"138.124.124.0/24\", \"138.124.127.0/24\", \"147.45.40.0/22\", \"147.45.68.0/22\", \"147.45.72.0/21\", \"176.124.198.0/23\", \"176.124.202.0/23\", \"176.124.204.0/22\", \"176.124.220.0/23\", \"176.124.222.0/24\", \"178.20.208.0/23\", \"178.159.94.0/24\", \"178.236.246.0/23\", \"178.236.248.0/24\", \"178.236.250.0/23\", \"178.236.252.0/24\", \"178.236.255.0/24\", \"185.68.244.0/24\", \"185.96.80.0/24\", \"185.103.100.0/22\", \"185.104.151.0/24\", \"185.125.100.0/22\", \"185.197.74.0/24\", \"185.221.196.0/24\", \"185.221.199.0/24\", \"185.230.143.0/24\", \"185.246.217.0/24\", \"193.8.215.0/24\", \"193.29.224.0/23\", \"193.32.8.0/24\", \"193.33.153.0/24\", \"193.188.20.0/23\", \"193.188.22.0/24\", \"193.232.178.0/24\", \"193.233.88.0/22\", \"193.233.128.0/23\", \"193.233.133.0/24\", \"193.233.136.0/22\", \"193.233.161.0/24\", \"193.233.201.0/24\", \"193.233.208.0/22\", \"193.233.216.0/21\", \"193.233.230.0/23\", \"193.233.232.0/23\", \"193.233.244.0/22\", \"193.233.248.0/22\", \"194.26.229.0/24\", \"194.33.34.0/23\", \"194.59.186.0/24\", \"194.76.217.0/24\", \"194.113.106.0/24\", \"194.226.169.0/24\", \"195.74.90.0/24\", \"212.113.100.0/22\", \"212.113.106.0/24\", \"212.113.116.0/24\", \"212.113.119.0/24\", \"213.21.229.0/24\", \"213.21.233.0/24\", \"213.21.235.0/24\", \"213.21.242.0/24\", \"213.21.246.0/24\", \"213.21.250.0/23\", \"213.21.252.0/24\", \"213.21.254.0/24\", \"213.108.20.0/22\", \"213.165.32.0/21\", \"213.165.40.0/22\", \"213.165.44.0/24\", \"213.165.46.0/24\", \"213.165.48.0/23\", \"213.176.64.0/22\", \"213.176.112.0/22\", \"217.144.184.0/21\", \"2a01:e5c0::/33\", \"2a01:e5c0:8003::/48\", \"2a01:e5c0:8004::/48\", \"2a01:e5c0:8008::/48\", \"2a0b:4140:1000::/36\", \"2a0b:4140:2000::/35\", \"2a0b:4140:4000::/34\", \"2a0b:4140:9000::/36\", \"2a0b:4140:a000::/35\", \"2a0b:4140:c000::/34\", \"2a0e:b107:2780::/46\", \"2a0f:cdc6:2010::/44\", \"2a0f:cdc6:2020::/44\", \"2a0f:cdc6:5030::/44\", \"2a11:fc80::/29\", \"2a12:5940:1::/48\", \"2a12:5940:1000::/36\", \"2a12:5940:2000::/35\", \"2a12:5940:4000::/34\", \"2a12:5940:8000::/33\", \"2a14:a084::/35\", \"2a14:a084:2000::/36\")"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Observed IOC: Malicious sender domains

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Domain, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • sender.email
  • type

Rule body

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.domain) in (
  '049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515', // Observed malicious sender domain
  '28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770', // Malicious Sender - Multiple Lures spaning multiple days
  '2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead', // Observed malicious sender domain
  '2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0', // Observed malicious sender domain
  '344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '716ebb3424a6e8ef5ec500c3e6cf3a4f44c7901033d95352ee1db8d656e2878e', // Observed malicious sender domain
  '90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd789e66005bd9398bcf48a0f28845f20b3678f4d0a2b44932e8c168fcfe22be7', // Observed malicious sender domain
  'de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'ec22dbb0ccf84314288fdd0cf30bfce860451b90d8e4b29a1c2a1c03b2172d41', // Observed malicious sender domain
  'ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd' // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
)

Detection logic

Scope: inbound message.

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.domain.domain) in ('049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6', '093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515', '28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770', '2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead', '2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0', '344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1', '6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313', '6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c', '716ebb3424a6e8ef5ec500c3e6cf3a4f44c7901033d95352ee1db8d656e2878e', '90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b', 'bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7', 'd758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d', 'd789e66005bd9398bcf48a0f28845f20b3678f4d0a2b44932e8c168fcfe22be7', 'de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965', 'ec22dbb0ccf84314288fdd0cf30bfce860451b90d8e4b29a1c2a1c03b2172d41', 'ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd')

Inspects: sender.email.domain.domain, type.inbound. Sensors: hash.sha256.

Stages and Predicates

Stage 1: mql_rule

and
  hash.sha256 func_call "hash.sha256(sender.email.domain.domain) in (049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6, 093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515, 28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770, 2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead, 2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0, 344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1, 6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313, 6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c, 716ebb3424a6e8ef5ec500c3e6cf3a4f44c7901033d95352ee1db8d656e2878e, 90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b, bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7, d758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d, d789e66005bd9398bcf48a0f28845f20b3678f4d0a2b44932e8c168fcfe22be7, de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965, ec22dbb0ccf84314288fdd0cf30bfce860451b90d8e4b29a1c2a1c03b2172d41, ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd)"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Observed IOC: Malicious sender email addresses

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Email address, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • sender.email
  • type

Rule body

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.email) in (
  '0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '00b060930b9543a8e53680eeec51b8f0ea26171f841ba405b6a2bae4f4a16d13', // Observed malicious sender
  '00c776ad4b5b0f14f43a5ea3c74c7c7ad72ecde85ab36784d4df4bd854b418e3', // Observed malicious sender - suspected compromised account
  '01daaaf6426a9d5fce08d9e580ae4e99a1d29aa744c3091c283920cfa2961c04', // Observed malicious sender - suspected compromised account
  '01fb95a71c2e61353d73ad4b540297927f8c3c94cf82605e0362e9e08919241b', // Observed malicious sender
  '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '04ad2551e2fb00d428e8ea108ee3a793a68d4bdb23507909059d32456bc89175', // Observed malicious sender
  '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '07d8ce9b8ddc16e03d9808389e32770b9f5d4bca42cda29634dd8c4218c2d8b8', // Observed malicious sender - suspected compromised account
  '081f3b1396564e1f1dedb277f41627bd7e9f91f7a569db9e15f6c195c1d5831b', // Observed malicious sender
  '0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '0bc24e314a84b7c97d4afae97511506aca1cebaf481a906e20e264beb8ea7da7', // Observed malicious sender
  '0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '1f80dafe55a4d6adbbc05490e1957dfd24988686ca8b4b59d810845966f214dc', // Observed malicious sender
  '1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '273ead1b544583c83904a980ac566ca06c890ab5ce3e3099479d16ef8ee56421', // Observed malicious sender
  '282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '29c91cd7bdaefab7963470c9026d93a759085c31c9fe1dda02053347eff120e1', // Observed malicious sender - suspected compromised account
  '2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '3d601a39c067806016b8be159e2fc3f7965733c0714bbbd3e6b4a8cf442aa3b3', // Observed malicious sender
  '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '43c7051606c766ea9c941acd9e06176eac1e03144619d0a7860018430fd93ce7', // Observed malicious sender
  '43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '615c14f44c9280f9cf9aa5281f970a5313f131783852b454d6f9b49ec918daca', // Observed malicious sender
  '637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '66cda4906b1add76bef47c87457acae80767c823325ddf01abca7f05f0b94f60', // Observed malicious sender
  '6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '68f31b98d1f1d9b1ba3698a155a5a47484c4e674b371c866189cb143afcd70c4', // Observed malicious sender
  '69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '7b538d3d84e5313ff0fa4786170ae34f38cddaf5c34a2b8c7b8f1cc23cea0abd', // Observed malicious sender
  '7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '7e5b8d0b4fedc8b2266d9dcf49693fde1bf985750f7c86be76d8d7e02641762b', // Observed malicious sender
  '7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '888dd9ea634f8224ab165afc4ac7596d2bfcb009739c054425e5794e6a1d4dd0', // Observed malicious sender
  '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '8e54f90fa7e47835cbb71d612b21b611fae8646c152b17041c5834d331cc4fed', // Observed malicious sender
  '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', // Compromised real account used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'be2f7fdb0c9cbc424ba760004bda0ecfb2fff4032a083f214e7ec3ea20b9cc33', // Observed malicious sender
  'be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5', // Observed malicious sender
  'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', // Observed malicious sender
  'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'c43bfeb172551e7a4f9ad23862e3b6d743328973acd29a5e2fc245d6cec78ea6', // Observed malicious sender
  'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd1105548f3549d3e676268efbdf0f0a419cba259317738f3a322f68a3b042461', // Observed malicious sender
  'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'd9e35c658926e961b6b1a68473a9957230a6e490198983460b101232f1c616a0', // Observed malicious sender
  'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'eb1e5843a298cfb84f6b443ee59e3e5385a9d047dccb2e2d568e71b8688d74a5', // Observed malicious sender
  'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'f4db533881dd346485a0167dc80828daa28a8c2079f513041c813da3545c68a8', // Observed malicious sender
  'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'fd0a02e65301f811a3a46623232053d9751380e5339386b459d4bd668e6a2f81', // Observed malicious sender
  'fe218207660e4c9570cea198ab32c90af1e8ea7449f188b9f3683246a1808ca3', // Observed malicious sender
  'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0' // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
)

Detection logic

Scope: inbound message.

Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.email) in ('0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', '00b060930b9543a8e53680eeec51b8f0ea26171f841ba405b6a2bae4f4a16d13', '00c776ad4b5b0f14f43a5ea3c74c7c7ad72ecde85ab36784d4df4bd854b418e3', '01daaaf6426a9d5fce08d9e580ae4e99a1d29aa744c3091c283920cfa2961c04', '01fb95a71c2e61353d73ad4b540297927f8c3c94cf82605e0362e9e08919241b', '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', '04ad2551e2fb00d428e8ea108ee3a793a68d4bdb23507909059d32456bc89175', '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', '062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', '071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', '072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', '07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', '07d8ce9b8ddc16e03d9808389e32770b9f5d4bca42cda29634dd8c4218c2d8b8', '081f3b1396564e1f1dedb277f41627bd7e9f91f7a569db9e15f6c195c1d5831b', '0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', '0bc24e314a84b7c97d4afae97511506aca1cebaf481a906e20e264beb8ea7da7', '0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', '0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', '0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', '0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', '110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', '1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', '12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', '12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', '131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', '16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', '16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', '16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', '1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', '18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', '19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', '1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', '1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', '1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', '1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', '1f80dafe55a4d6adbbc05490e1957dfd24988686ca8b4b59d810845966f214dc', '1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', '2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', '217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', '236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', '2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', '23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', '23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', '2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', '249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', '273ead1b544583c83904a980ac566ca06c890ab5ce3e3099479d16ef8ee56421', '282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', '298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', '29c91cd7bdaefab7963470c9026d93a759085c31c9fe1dda02053347eff120e1', '2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', '2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', '30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', '306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', '3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', '36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', '38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', '38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', '3d601a39c067806016b8be159e2fc3f7965733c0714bbbd3e6b4a8cf442aa3b3', '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', '4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', '43c7051606c766ea9c941acd9e06176eac1e03144619d0a7860018430fd93ce7', '43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', '45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', '48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', '4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', '4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', '5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', '5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', '50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', '521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', '54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', '54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', '5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', '597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', '5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', '5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', '5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', '5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', '5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', '5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', '5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', '6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', '615c14f44c9280f9cf9aa5281f970a5313f131783852b454d6f9b49ec918daca', '637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', '63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', '66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', '66cda4906b1add76bef47c87457acae80767c823325ddf01abca7f05f0b94f60', '6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', '682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', '68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', '68f31b98d1f1d9b1ba3698a155a5a47484c4e674b371c866189cb143afcd70c4', '69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', '69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', '6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', '6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', '6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', '6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', '7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', '70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', '70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', '73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', '746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', '7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', '762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', '766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', '77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', '7b538d3d84e5313ff0fa4786170ae34f38cddaf5c34a2b8c7b8f1cc23cea0abd', '7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', '7e5b8d0b4fedc8b2266d9dcf49693fde1bf985750f7c86be76d8d7e02641762b', '7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', '80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', '85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', '888dd9ea634f8224ab165afc4ac7596d2bfcb009739c054425e5794e6a1d4dd0', '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', '8e54f90fa7e47835cbb71d612b21b611fae8646c152b17041c5834d331cc4fed', '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', '91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', '92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', '9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', '9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', 'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', 'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', 'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', 'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', 'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', 'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', 'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', 'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', 'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', 'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', 'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', 'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', 'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', 'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', 'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', 'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', 'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', 'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', 'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', 'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', 'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', 'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', 'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', 'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', 'be2f7fdb0c9cbc424ba760004bda0ecfb2fff4032a083f214e7ec3ea20b9cc33', 'be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5', 'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', 'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', 'c43bfeb172551e7a4f9ad23862e3b6d743328973acd29a5e2fc245d6cec78ea6', 'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', 'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', 'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', 'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', 'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', 'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', 'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', 'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', 'd1105548f3549d3e676268efbdf0f0a419cba259317738f3a322f68a3b042461', 'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', 'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', 'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', 'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', 'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', 'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', 'd9e35c658926e961b6b1a68473a9957230a6e490198983460b101232f1c616a0', 'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', 'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', 'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', 'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', 'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', 'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', 'eb1e5843a298cfb84f6b443ee59e3e5385a9d047dccb2e2d568e71b8688d74a5', 'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', 'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', 'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', 'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', 'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', 'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', 'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', 'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', 'f4db533881dd346485a0167dc80828daa28a8c2079f513041c813da3545c68a8', 'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', 'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', 'fd0a02e65301f811a3a46623232053d9751380e5339386b459d4bd668e6a2f81', 'fe218207660e4c9570cea198ab32c90af1e8ea7449f188b9f3683246a1808ca3', 'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0')

Inspects: sender.email.email, type.inbound. Sensors: hash.sha256.

Stages and Predicates

Stage 1: mql_rule

and
  hash.sha256 func_call "hash.sha256(sender.email.email) in (0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a, 0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba, 00b060930b9543a8e53680eeec51b8f0ea26171f841ba405b6a2bae4f4a16d13, 00c776ad4b5b0f14f43a5ea3c74c7c7ad72ecde85ab36784d4df4bd854b418e3, 01daaaf6426a9d5fce08d9e580ae4e99a1d29aa744c3091c283920cfa2961c04, 01fb95a71c2e61353d73ad4b540297927f8c3c94cf82605e0362e9e08919241b, 03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62, 04ad2551e2fb00d428e8ea108ee3a793a68d4bdb23507909059d32456bc89175, 054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726, 062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11, 071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517, 072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb, 07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7, 07d8ce9b8ddc16e03d9808389e32770b9f5d4bca42cda29634dd8c4218c2d8b8, 081f3b1396564e1f1dedb277f41627bd7e9f91f7a569db9e15f6c195c1d5831b, 0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71, 0bc24e314a84b7c97d4afae97511506aca1cebaf481a906e20e264beb8ea7da7, 0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1, 0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605, 0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7, 0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189, 110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527, 1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f, 12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb, 12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724, 131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d, 16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b, 16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014, 16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a, 1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e, 18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e, 19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924, 1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f, 1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118, 1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0, 1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4, 1f80dafe55a4d6adbbc05490e1957dfd24988686ca8b4b59d810845966f214dc, 1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a, 2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d, 217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d, 236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f, 2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4, 23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1, 23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7, 2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517, 249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54, 273ead1b544583c83904a980ac566ca06c890ab5ce3e3099479d16ef8ee56421, 282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b, 298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8, 29c91cd7bdaefab7963470c9026d93a759085c31c9fe1dda02053347eff120e1, 2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182, 2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29, 30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25, 306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1, 3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806, 36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff, 38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c, 38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e, 3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231, 3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806, 3d601a39c067806016b8be159e2fc3f7965733c0714bbbd3e6b4a8cf442aa3b3, 4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a, 4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542, 43c7051606c766ea9c941acd9e06176eac1e03144619d0a7860018430fd93ce7, 43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d, 45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff, 48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59, 4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a, 4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c, 5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b, 5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35, 50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f, 521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397, 54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99, 54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3, 5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1, 597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7, 5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f, 5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b, 5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290, 5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed, 5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a, 5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb, 5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537, 6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e, 615c14f44c9280f9cf9aa5281f970a5313f131783852b454d6f9b49ec918daca, 637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944, 63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483, 66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe, 66cda4906b1add76bef47c87457acae80767c823325ddf01abca7f05f0b94f60, 6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367, 682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605, 68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec, 68f31b98d1f1d9b1ba3698a155a5a47484c4e674b371c866189cb143afcd70c4, 69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd, 69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92, 6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde, 6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821, 6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c, 6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254, 7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055, 70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193, 70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc, 73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912, 746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b, 7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e, 762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca, 766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd, 77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524, 7b538d3d84e5313ff0fa4786170ae34f38cddaf5c34a2b8c7b8f1cc23cea0abd, 7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f, 7e5b8d0b4fedc8b2266d9dcf49693fde1bf985750f7c86be76d8d7e02641762b, 7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15, 80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be, 85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b, 888dd9ea634f8224ab165afc4ac7596d2bfcb009739c054425e5794e6a1d4dd0, 89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec, 8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741, 8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355, 8e54f90fa7e47835cbb71d612b21b611fae8646c152b17041c5834d331cc4fed, 8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f, 904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10, 91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059, 92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f, 9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502, 949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7, 94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98, 95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a, 99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc, 9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8, 9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6, a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b, a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113, a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c, a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc, a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed, a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f, a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1, a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57, a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7, a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7, a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b, abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8, aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c, b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515, b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766, b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf, b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe, b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448, b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b, b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9, b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399, b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a, b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5, bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf, be2f7fdb0c9cbc424ba760004bda0ecfb2fff4032a083f214e7ec3ea20b9cc33, be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5, bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6, c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97, c43bfeb172551e7a4f9ad23862e3b6d743328973acd29a5e2fc245d6cec78ea6, c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec, c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc, ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081, cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593, ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16, cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c, cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d, cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2, d1105548f3549d3e676268efbdf0f0a419cba259317738f3a322f68a3b042461, d727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f, d74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4, d7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5, d8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4, d9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552, d9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42, d9e35c658926e961b6b1a68473a9957230a6e490198983460b101232f1c616a0, e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376, e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff, e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077, e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd, e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c, e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d, eb1e5843a298cfb84f6b443ee59e3e5385a9d047dccb2e2d568e71b8688d74a5, eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2, ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90, eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503, f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52, f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf, f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170, f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60, f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf, f4db533881dd346485a0167dc80828daa28a8c2079f513041c813da3545c68a8, fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771, fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada, fd0a02e65301f811a3a46623232053d9751380e5339386b459d4bd668e6a2f81, fe218207660e4c9570cea198ab32c90af1e8ea7449f188b9f3683246a1808ca3, fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0)"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Observed IOC: Malicious sender root domains

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Domain, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • sender.email
  • type

Rule body

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.root_domain) in (
  '0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
  '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
  '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
  '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
  '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
  '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
  'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
  'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
  'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
  'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f' // Brand impersonation giveaways with AFF
)

Detection logic

Scope: inbound message.

Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.domain.root_domain) in ('0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', 'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', 'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', 'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', 'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f')

Inspects: sender.email.domain.root_domain, type.inbound. Sensors: hash.sha256.

Stages and Predicates

Stage 1: mql_rule

and
  hash.sha256 func_call "hash.sha256(sender.email.domain.root_domain) in (0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626, 3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786, 62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec, 674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff, 724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268, 91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b, a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36, ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d, e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78, e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f)"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"