detection.wiki

Detection rules › Sublime MQL

Observed IOC: Malicious sender domains

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Domain, Social engineering

Event coverage

Message attribute
sender.email
type

Rule body MQL

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.domain) in (
  '28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770' // Malicious Sender - Multiple Lures spaning multiple days
)

Detection logic

Scope: inbound message.

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.domain.domain) in ('28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770')

Inspects: sender.email.domain.domain, type.inbound. Sensors: hash.sha256.