detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: punycode

RuleSeverity
Punycode sender domainhigh

Punycode sender domain

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Lookalike domain, Punycode, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • sender.email
  • type

Rule body

type.inbound
and strings.ilike(sender.email.domain.domain, "*xn--*")

Detection logic

Scope: inbound message.

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

  1. inbound message
  2. sender.email.domain.domain matches '*xn--*'

Inspects: sender.email.domain.domain, type.inbound. Sensors: strings.ilike.

Indicators matched (1)

FieldMatchValue
strings.ilikesubstring*xn--*

Stages and Predicates

Stage 1: mql_rule

and
  sender.email.domain.domain match "xn--"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
sender.email.domain.domainwildcard
  • *xn--*
field:"sender.email.domain.domain" kind:wildcard value:"*xn--*"
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"