Detection rules › Sublime MQL
Observed IOC: Malicious sender root domains
Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Impersonation: Domain, Social engineering |
Event coverage
| Message attribute |
|---|
| sender.email |
| type |
Rule body MQL
// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.root_domain) in (
'0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
'3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
'62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
'674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
'724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
'91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f' // Brand impersonation giveaways with AFF
)
Detection logic
Scope: inbound message.
Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.
- inbound message
- hash.sha256(sender.email.domain.root_domain) in ('0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', 'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', 'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', 'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', 'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f')
Inspects: sender.email.domain.root_domain, type.inbound. Sensors: hash.sha256.