detection.wiki

Detection rules › Sublime MQL

Observed IOC: Malicious sender email addresses

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Email address, Social engineering

Event coverage

Message attribute
sender.email
type

Rule body MQL

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.email) in (
  '7affbe4b711761fcbeea34fafe0df6d217463064e60510e12af92b57dbfbf186', // Observed malicious sender
  '8030cd12e522cf160c85171bfaee999d095e79bd66815d4604f5e4406a1c566c', // Observed malicious sender - multiple cred phish lures
  'b2051a0fd6b19df331f4ee71671c8a6fc621544fb046574edd8233a585247d0a', // Observed malicious sender
  'd3193407cf75baf52783c7bfc1929e7c968cd71d113c12cba0b4b31e68dce8ff' // Observed malicious sender
)

Detection logic

Scope: inbound message.

Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.email) in ('7affbe4b711761fcbeea34fafe0df6d217463064e60510e12af92b57dbfbf186', '8030cd12e522cf160c85171bfaee999d095e79bd66815d4604f5e4406a1c566c', 'b2051a0fd6b19df331f4ee71671c8a6fc621544fb046574edd8233a585247d0a', 'd3193407cf75baf52783c7bfc1929e7c968cd71d113c12cba0b4b31e68dce8ff')

Inspects: sender.email.email, type.inbound. Sensors: hash.sha256.