detection.wiki

Detection rules › Sublime MQL

QR Code with suspicious indicators

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule flags messages with QR codes in attachments when there are three or fewer attachments. If no attachments are present, the rule captures a screenshot of the message for analysis. Additional triggers include: sender's name containing the recipient's SLD, recipient's email mentioned in the body, an empty message body, a suspicious subject, or undisclosed recipients.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesQR code, Social engineering

Event coverage

Message attribute
attachments (collection)
body.current_thread
body.html
headers (collection)
headers.auth_summary
recipients
recipients.to (collection)
sender
sender.email
subject
type

Rule body MQL

type.inbound
and (
  (
    length(attachments) <= 3
    or (
      any(attachments, length(ml.logo_detect(.).brands) > 0)
      and length(attachments) <= 10
    )
  )
  and (
    any(attachments,
        (
          .file_type in $file_types_images
          or .file_extension in $file_extensions_macros
          or .file_type == "pdf"
        )
        and (
          any(file.explode(.),
              (
                .scan.qr.type is not null
                and regex.contains(.scan.qr.data, '\.')
                and not strings.starts_with(.scan.qr.data,
                                            "https://qr.skyqr.co.za/"
                )
                and not (
                  strings.icontains(.scan.qr.data, ',')
                  and .scan.qr.type == 'undefined'
                )
                // not a json string
                and not (
                  strings.starts_with(.scan.qr.data, '{')
                  and strings.ends_with(.scan.qr.data, '}')
                )
                // exclude images taken with mobile cameras and screenshots from android
                and not any(.scan.exiftool.fields,
                            .key == "Model"
                            or (
                              .key == "Software"
                              and strings.starts_with(.value, "Android")
                            )
                )
                // exclude images taken with mobile cameras and screenshots from Apple
                and not any(.scan.exiftool.fields,
                            .key == "DeviceManufacturer"
                            and .value == "Apple Computer Inc."
                )
                // exclude images from WhatsApp (mobile)
                and not regex.match(.file_name,
                                    'WhatsApp Image \d\d\d\d-\d\d-\d\d at.*.jpe?g'
                )
                and not (
                  (
                    .scan.exiftool.image_height > 3000
                    and .scan.exiftool.image_height is not null
                  )
                  or (
                    .scan.exiftool.image_width > 3000
                    and .scan.exiftool.image_width is not null
                  )
                )
                // exclude contact cards
                and not strings.istarts_with(.scan.qr.data, "BEGIN:VCARD")

                // negate QR codes to legit Servicio de Administración Tributaria (SAT) Gov links
                and not (
                  .scan.qr.url.domain.root_domain is not null
                  and .scan.qr.url.domain.root_domain in ('sat.gob.mx')
                )
                and not (
                  .scan.qr.data is not null
                  and strings.icontains(.scan.qr.data, 'sat.gob.mx')
                )
              )
              or (
                regex.icontains(.scan.ocr.raw,
                                '(?:scan|camera|review and sign)'
                )
                and regex.icontains(.scan.ocr.raw, '(?:\bQR\b|Q\.R\.|barcode)')
              )
          )
        )
    )
    or (
      length(attachments) == 0
      //
      // This rule makes use of a beta feature and is subject to change without notice
      // using the beta feature in custom rules is not suggested until it has been formally released
      //
      and (
        (
          beta.parse_exif(file.message_screenshot()).image_height < 2000
          and beta.parse_exif(file.message_screenshot()).image_width < 2000
        )
        // ignore image height/width if there is excessive whitespace padding
        or regex.contains(body.html.raw, '\"padding:0px 0px \d{3,4}px 0px')
      )
      and any(beta.scan_qr(file.message_screenshot()).items,
              .type is not null
              and regex.contains(.data, '\.')
              // exclude contact cards
              and not strings.istarts_with(.data, "BEGIN:VCARD")
      )
    )
  )
  and (
    any(recipients.to,
        strings.icontains(sender.display_name, .email.domain.sld)
    )
    or length(body.current_thread.text) is null
    or (
      body.current_thread.text == ""
      and (
        (
          (length(headers.references) > 0 or headers.in_reply_to is null)
          and not (
            (
              strings.istarts_with(subject.subject, "RE:")
              or strings.istarts_with(subject.subject, "RES:")
              or strings.istarts_with(subject.subject, "R:")
              or strings.istarts_with(subject.subject, "ODG:")
              or strings.istarts_with(subject.subject, "答复:")
              or strings.istarts_with(subject.subject, "AW:")
              or strings.istarts_with(subject.subject, "TR:")
              or strings.istarts_with(subject.subject, "FWD:")
              or regex.imatch(subject.subject,
                              '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
              )
            )
          )
        )
        or length(headers.references) == 0
      )
    )
    or regex.contains(subject.subject,
                      "(Authenticat(e|or|ion)|2fa|Multi.Factor|(qr|bar).code|action.require|alert|Att(n|ention):)"
    )
    or (any(recipients.to, strings.icontains(subject.subject, .display_name)))
    or (
      regex.icontains(subject.subject,
                      "termination.*notice",
                      "38417",
                      ":completed",
                      "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                      "[il][il][il]egai[ -]",
                      "[li][li][li]ega[li] attempt",
                      "[ng]-?[io]n .*block",
                      "[ng]-?[io]n .*cancel",
                      "[ng]-?[io]n .*deactiv",
                      "[ng]-?[io]n .*disabl",
                      "action.*required",
                      "abandon.*package",
                      "about.your.account",
                      "acc(ou)?n?t (is )?on ho[li]d",
                      "acc(ou)?n?t.*terminat",
                      "acc(oun)?t.*[il1]{2}mitation",
                      "access.*limitation",
                      "account (will be )?block",
                      "account.*de-?activat",
                      "account.*locked",
                      "account.*re-verification",
                      "account.*security",
                      "account.*suspension",
                      "account.has.been",
                      "account.has.expired",
                      "account.will.be.blocked",
                      "account v[il]o[li]at",
                      "activity.*acc(oun)?t",
                      "all.?staff",
                      "almost.full",
                      "app[li]e.[il]d",
                      "authenticate.*account",
                      "been.*suspend",
                      "bonus",
                      "clos.*of.*account.*processed",
                      "confirm.your.account",
                      "courier.*able",
                      "crediential.*notif",
                      "deactivation.*in.*progress",
                      "delivery.*attempt.*failed",
                      "document.received",
                      "documented.*shared.*with.*you",
                      "dropbox.*document",
                      "e-?ma[il1]+ .{010}suspen",
                      "e-?ma[il1]{1} user",
                      "e-?ma[il1]{2} acc",
                      "e-?ma[il1]{2}.*up.?grade",
                      "e.?ma[il1]{2}.*server",
                      "e.?ma[il1]{2}.*suspend",
                      "email.update",
                      "faxed you",
                      "fraud(ulent)?.*charge",
                      "from.helpdesk",
                      "fu[il1]{2}.*ma[il1]+[ -]?box",
                      "has.been.*suspended",
                      "has.been.limited",
                      "have.locked",
                      "he[li]p ?desk upgrade",
                      "heipdesk",
                      "i[il]iega[il]",
                      "ii[il]ega[il]",
                      "incoming e?mail",
                      "incoming.*fax",
                      "lock.*security",
                      "ma[il1]{1}[ -]?box.*quo",
                      "ma[il1]{2}[ -]?box.*fu[il1]",
                      "ma[il1]{2}box.*[il1]{2}mit",
                      "ma[il1]{2}box stor",
                      "mail on.?hold",
                      "mail.*box.*migration",
                      "mail.*de-?activat",
                      "mail.update.required",
                      "mails.*pending",
                      "messages.*pending",
                      "missed.*shipping.*notification",
                      "missed.shipment.notification",
                      "must.update.your.account",
                      "new [sl][io]g?[nig][ -]?in from",
                      "new voice ?-?mail",
                      "notifications.*pending",
                      "office.*3.*6.*5.*suspend",
                      "office365",
                      "on google docs with you",
                      "online doc",
                      "password.*compromised",
                      "payment advice",
                      "periodic maintenance",
                      "potential(ly)? unauthorized",
                      "refund not approved",
                      "report",
                      "revised.*policy",
                      "scam",
                      "scanned.?invoice",
                      "secured?.update",
                      "security breach",
                      "securlty",
                      "seguranca",
                      "signed.*delivery",
                      "status of your .{314}? ?delivery",
                      "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                      "suspicious.*sign.*[io]n",
                      "suspicious.activit",
                      "temporar(il)?y deactivate",
                      "temporar[il1]{2}y disab[li]ed",
                      "temporarily.*lock",
                      "un-?usua[li].activity",
                      "unable.*deliver",
                      "unauthorized.*activit",
                      "unauthorized.device",
                      "undelivered message",
                      "unread.*doc",
                      "unusual.activity",
                      "upgrade.*account",
                      "upgrade.notice",
                      "urgent message",
                      "urgent.verification",
                      "v[il1]o[li1]at[il1]on security",
                      "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                      "verification ?-?require",
                      "verification( )?-?need",
                      "verify.your?.account",
                      "web ?-?ma[il1]{2}",
                      "web[ -]?ma[il1]{2}",
                      "will.be.suspended",
                      "your (customer )?account .as",
                      "your.office.365",
                      "your.online.access"
      )
      or any($suspicious_subjects, strings.icontains(subject.subject, .))
      or regex.icontains(sender.display_name,
                         "Accounts.?Payable",
                         "Admin",
                         "Administrator",
                         "Alert",
                         "Assistant",
                         "Billing",
                         "Benefits",
                         "Bonus",
                         "CEO",
                         "CFO",
                         "CIO",
                         "CTO",
                         "Chairman",
                         "Claim",
                         "Confirm",
                         "Critical",
                         "Customer Service",
                         "Deal",
                         "Discount",
                         "Director",
                         "Exclusive",
                         "Executive",
                         "Fax",
                         "Free",
                         "Gift",
                         "/bHR/b",
                         "Helpdesk",
                         "Human Resources",
                         "Immediate",
                         "Important",
                         "Info",
                         "Information",
                         "Invoice",
                         '\bIT\b',
                         "Legal",
                         "Lottery",
                         "Management",
                         "Manager",
                         "Member Services",
                         "Notification",
                         "Offer",
                         "Operations",
                         "Order",
                         "Partner",
                         "Payment",
                         "Payroll",
                         "President",
                         "Premium",
                         "Prize",
                         "Receipt",
                         "Refund",
                         "Registrar",
                         "Required",
                         "Reward",
                         "Sales",
                         "Secretary",
                         "Security",
                         "Service",
                         "Signature",
                         "StaffAnnouncement",
                         "Storage",
                         "Support",
                         "Sweepstakes",
                         "System",
                         "Tax",
                         "Tech Support",
                         "Update",
                         "Upgrade",
                         "Urgent",
                         "Validate",
                         "Verify",
                         "VIP",
                         "Webmaster",
                         "Winner",
      )
    )
    or (
      (
        length(recipients.to) == 0
        or all(recipients.to, .display_name == "Undisclosed recipients")
      )
      and length(recipients.cc) == 0
      and length(recipients.bcc) == 0
    )
    or any(beta.scan_qr(file.message_screenshot()).items,
           (
             .url.domain.tld in $suspicious_tlds
             and .url.domain.root_domain != "app.link"
           )
           // linkanalysis phishing disposition
           or ml.link_analysis(.url).credphish.disposition == "phishing"
    )
    or any(attachments,
           (
             .file_type in $file_types_images
             or .file_extension in $file_extensions_macros
             or .file_type == "pdf"
           )
           and any(file.explode(.),
                   (
                     .scan.qr.url.domain.tld in $suspicious_tlds
                     and .scan.qr.url.domain.root_domain != "app.link"
                     and .scan.qr.url.domain.root_domain != "qr.link"
                     and .scan.qr.url.domain.root_domain != "skyqr.co.za"
                   )
                   and .scan.qr.url.domain.root_domain not in $org_domains
           )
    )
    or sender.email.domain.tld in $suspicious_tlds
  )
)

// sender profile is new or outlier
and (
  profile.by_sender_email().any_messages_malicious_or_spam
  or (
    sender.email.domain.domain in $org_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
  or (
    profile.by_sender_email().prevalence in ("new", "outlier")
    and not profile.by_sender_email().solicited
  )
)
and not profile.by_sender_email().any_messages_benign
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

This rule flags messages with QR codes in attachments when there are three or fewer attachments. If no attachments are present, the rule captures a screenshot of the message for analysis. Additional triggers include: sender's name containing the recipient's SLD, recipient's email mentioned in the body, an empty message body, a suspicious subject, or undisclosed recipients.

  1. inbound message
  2. all of:
    • any of:
      • length(attachments) ≤ 3
      • all of:
        • any of attachments where:
          • length(ml.logo_detect(.).brands) > 0
        • length(attachments) ≤ 10
    • any of:
      • any of attachments where all hold:
        • any of:
          • .file_type in $file_types_images
          • .file_extension in $file_extensions_macros
          • .file_type is 'pdf'
        • any of file.explode(.) where any holds:
          • all of:
            • .scan.qr.type is set
            • .scan.qr.data matches '\\.'
            • not:
              • .scan.qr.data starts with 'https://qr.skyqr.co.za/'
            • not:
              • all of:
                • .scan.qr.data contains ','
                • .scan.qr.type is 'undefined'
            • not:
              • all of:
                • .scan.qr.data starts with '{'
                • .scan.qr.data ends with '}'
            • not:
              • any of .scan.exiftool.fields where any holds:
                • .key is 'Model'
                • all of:
                  • .key is 'Software'
                  • .value starts with 'Android'
            • not:
              • any of .scan.exiftool.fields where all hold:
                • .key is 'DeviceManufacturer'
                • .value is 'Apple Computer Inc.'
            • not:
              • .file_name matches 'WhatsApp Image \\d\\d\\d\\d-\\d\\d-\\d\\d at.*.jpe?g'
            • none of:
              • all of:
                • .scan.exiftool.image_height > 3000
                • .scan.exiftool.image_height is set
              • all of:
                • .scan.exiftool.image_width > 3000
                • .scan.exiftool.image_width is set
            • not:
              • .scan.qr.data starts with 'BEGIN:VCARD'
            • not:
              • all of:
                • .scan.qr.url.domain.root_domain is set
                • .scan.qr.url.domain.root_domain in ('sat.gob.mx')
            • not:
              • all of:
                • .scan.qr.data is set
                • .scan.qr.data contains 'sat.gob.mx'
          • all of:
            • .scan.ocr.raw matches '(?:scan|camera|review and sign)'
            • .scan.ocr.raw matches '(?:\\bQR\\b|Q\\.R\\.|barcode)'
      • all of:
        • length(attachments) is 0
        • any of:
          • all of:
            • beta.parse_exif(file.message_screenshot()).image_height < 2000
            • beta.parse_exif(file.message_screenshot()).image_width < 2000
          • body.html.raw matches '\\"padding:0px 0px \\d{3,4}px 0px'
        • any of beta.scan_qr(file.message_screenshot()).items where all hold:
          • .type is set
          • .data matches '\\.'
          • not:
            • .data starts with 'BEGIN:VCARD'
    • any of:
      • any of recipients.to where:
        • strings.icontains(sender.display_name)
      • length(body.current_thread.text) is missing
      • all of:
        • body.current_thread.text is ''
        • any of:
          • all of:
            • any of:
              • length(headers.references) > 0
              • headers.in_reply_to is missing
            • none of:
              • subject.subject starts with 'RE:'
              • subject.subject starts with 'RES:'
              • subject.subject starts with 'R:'
              • subject.subject starts with 'ODG:'
              • subject.subject starts with '答复:'
              • subject.subject starts with 'AW:'
              • subject.subject starts with 'TR:'
              • subject.subject starts with 'FWD:'
              • subject.subject matches '(\\[[^\\]]+\\]\\s?){0,3}(re|fwd?|automat.*)\\s?:.*'
          • length(headers.references) is 0
      • subject.subject matches '(Authenticat(e|or|ion)|2fa|Multi.Factor|(qr|bar).code|action.require|alert|Att(n|ention):)'
      • any of recipients.to where:
        • strings.icontains(subject.subject)
      • any of:
        • subject.subject matches any of 127 patterns
          • termination.*notice
          • 38417
          • :completed
          • [il1]{2}mit.*ma[il1]{2} ?bo?x
          • [il][il][il]egai[ -]
          • [li][li][li]ega[li] attempt
          • [ng]-?[io]n .*block
          • [ng]-?[io]n .*cancel
          • [ng]-?[io]n .*deactiv
          • [ng]-?[io]n .*disabl
          • action.*required
          • abandon.*package
          • about.your.account
          • acc(ou)?n?t (is )?on ho[li]d
          • acc(ou)?n?t.*terminat
          • acc(oun)?t.*[il1]{2}mitation
          • access.*limitation
          • account (will be )?block
          • account.*de-?activat
          • account.*locked
          • account.*re-verification
          • account.*security
          • account.*suspension
          • account.has.been
          • account.has.expired
          • account.will.be.blocked
          • account v[il]o[li]at
          • activity.*acc(oun)?t
          • all.?staff
          • almost.full
          • app[li]e.[il]d
          • authenticate.*account
          • been.*suspend
          • bonus
          • clos.*of.*account.*processed
          • confirm.your.account
          • courier.*able
          • crediential.*notif
          • deactivation.*in.*progress
          • delivery.*attempt.*failed
          • document.received
          • documented.*shared.*with.*you
          • dropbox.*document
          • e-?ma[il1]+ .{010}suspen
          • e-?ma[il1]{1} user
          • e-?ma[il1]{2} acc
          • e-?ma[il1]{2}.*up.?grade
          • e.?ma[il1]{2}.*server
          • e.?ma[il1]{2}.*suspend
          • email.update
          • faxed you
          • fraud(ulent)?.*charge
          • from.helpdesk
          • fu[il1]{2}.*ma[il1]+[ -]?box
          • has.been.*suspended
          • has.been.limited
          • have.locked
          • he[li]p ?desk upgrade
          • heipdesk
          • i[il]iega[il]
          • ii[il]ega[il]
          • incoming e?mail
          • incoming.*fax
          • lock.*security
          • ma[il1]{1}[ -]?box.*quo
          • ma[il1]{2}[ -]?box.*fu[il1]
          • ma[il1]{2}box.*[il1]{2}mit
          • ma[il1]{2}box stor
          • mail on.?hold
          • mail.*box.*migration
          • mail.*de-?activat
          • mail.update.required
          • mails.*pending
          • messages.*pending
          • missed.*shipping.*notification
          • missed.shipment.notification
          • must.update.your.account
          • new [sl][io]g?[nig][ -]?in from
          • new voice ?-?mail
          • notifications.*pending
          • office.*3.*6.*5.*suspend
          • office365
          • on google docs with you
          • online doc
          • password.*compromised
          • payment advice
          • periodic maintenance
          • potential(ly)? unauthorized
          • refund not approved
          • report
          • revised.*policy
          • scam
          • scanned.?invoice
          • secured?.update
          • security breach
          • securlty
          • seguranca
          • signed.*delivery
          • status of your .{314}? ?delivery
          • susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
          • suspicious.*sign.*[io]n
          • suspicious.activit
          • temporar(il)?y deactivate
          • temporar[il1]{2}y disab[li]ed
          • temporarily.*lock
          • un-?usua[li].activity
          • unable.*deliver
          • unauthorized.*activit
          • unauthorized.device
          • undelivered message
          • unread.*doc
          • unusual.activity
          • upgrade.*account
          • upgrade.notice
          • urgent message
          • urgent.verification
          • v[il1]o[li1]at[il1]on security
          • va[il1]{1}date.*ma[il1]{2}[ -]?box
          • verification ?-?require
          • verification( )?-?need
          • verify.your?.account
          • web ?-?ma[il1]{2}
          • web[ -]?ma[il1]{2}
          • will.be.suspended
          • your (customer )?account .as
          • your.office.365
          • your.online.access
        • any of $suspicious_subjects where:
          • strings.icontains(subject.subject)
        • sender.display_name matches any of 74 patterns
          • Accounts.?Payable
          • Admin
          • Administrator
          • Alert
          • Assistant
          • Billing
          • Benefits
          • Bonus
          • CEO
          • CFO
          • CIO
          • CTO
          • Chairman
          • Claim
          • Confirm
          • Critical
          • Customer Service
          • Deal
          • Discount
          • Director
          • Exclusive
          • Executive
          • Fax
          • Free
          • Gift
          • /bHR/b
          • Helpdesk
          • Human Resources
          • Immediate
          • Important
          • Info
          • Information
          • Invoice
          • \bIT\b
          • Legal
          • Lottery
          • Management
          • Manager
          • Member Services
          • Notification
          • Offer
          • Operations
          • Order
          • Partner
          • Payment
          • Payroll
          • President
          • Premium
          • Prize
          • Receipt
          • Refund
          • Registrar
          • Required
          • Reward
          • Sales
          • Secretary
          • Security
          • Service
          • Signature
          • StaffAnnouncement
          • Storage
          • Support
          • Sweepstakes
          • System
          • Tax
          • Tech Support
          • Update
          • Upgrade
          • Urgent
          • Validate
          • Verify
          • VIP
          • Webmaster
          • Winner
      • all of:
        • any of:
          • length(recipients.to) is 0
          • all of recipients.to where:
            • .display_name is 'Undisclosed recipients'
        • length(recipients.cc) is 0
        • length(recipients.bcc) is 0
      • any of beta.scan_qr(file.message_screenshot()).items where any holds:
        • all of:
          • .url.domain.tld in $suspicious_tlds
          • .url.domain.root_domain is not 'app.link'
        • ml.link_analysis(.url).credphish.disposition is 'phishing'
      • any of attachments where all hold:
        • any of:
          • .file_type in $file_types_images
          • .file_extension in $file_extensions_macros
          • .file_type is 'pdf'
        • any of file.explode(.) where all hold:
          • all of:
            • .scan.qr.url.domain.tld in $suspicious_tlds
            • .scan.qr.url.domain.root_domain is not 'app.link'
            • .scan.qr.url.domain.root_domain is not 'qr.link'
            • .scan.qr.url.domain.root_domain is not 'skyqr.co.za'
          • .scan.qr.url.domain.root_domain not in $org_domains
      • sender.email.domain.tld in $suspicious_tlds
  3. any of:
    • profile.by_sender_email().any_messages_malicious_or_spam
    • all of:
      • sender.email.domain.domain in $org_domains
      • not:
        • coalesce(headers.auth_summary.dmarc.pass)
    • all of:
      • profile.by_sender_email().prevalence in ('new', 'outlier')
      • not:
        • profile.by_sender_email().solicited
  4. not:
    • profile.by_sender_email().any_messages_benign
  5. not:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: attachments[].file_extension, attachments[].file_type, body.current_thread.text, body.html.raw, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.sld, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.domain.tld, subject.subject, type.inbound. Sensors: beta.parse_exif, beta.scan_qr, file.explode, file.message_screenshot, ml.link_analysis, ml.logo_detect, profile.by_sender_email, regex.contains, regex.icontains, regex.imatch, regex.match, strings.ends_with, strings.icontains, strings.istarts_with, strings.starts_with. Reference lists: $file_extensions_macros, $file_types_images, $high_trust_sender_root_domains, $org_domains, $suspicious_subjects, $suspicious_tlds.

Indicators matched (232)

FieldMatchValue
attachments[].file_typeequalspdf
regex.containsregex\.
strings.starts_withprefixhttps://qr.skyqr.co.za/
strings.icontainssubstring,
file.explode(attachments[])[].scan.qr.typeequalsundefined
strings.starts_withprefix{
strings.ends_withsuffix}
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsModel
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsSoftware
strings.starts_withprefixAndroid
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsDeviceManufacturer
file.explode(attachments[])[].scan.exiftool.fields[].valueequalsApple Computer Inc.
220 more
regex.matchregexWhatsApp Image \d\d\d\d-\d\d-\d\d at.*.jpe?g
strings.istarts_withprefixBEGIN:VCARD
file.explode(attachments[])[].scan.qr.url.domain.root_domainmembersat.gob.mx
strings.icontainssubstringsat.gob.mx
regex.icontainsregex(?:scan|camera|review and sign)
regex.icontainsregex(?:\bQR\b|Q\.R\.|barcode)
regex.containsregex\"padding:0px 0px \d{3,4}px 0px
body.current_thread.textequals
strings.istarts_withprefixRE:
strings.istarts_withprefixRES:
strings.istarts_withprefixR:
strings.istarts_withprefixODG:
strings.istarts_withprefix答复:
strings.istarts_withprefixAW:
strings.istarts_withprefixTR:
strings.istarts_withprefixFWD:
regex.imatchregex(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*
regex.containsregex(Authenticat(e|or|ion)|2fa|Multi.Factor|(qr|bar).code|action.require|alert|Att(n|ention):)
regex.icontainsregextermination.*notice
regex.icontainsregex38417
regex.icontainsregex:completed
regex.icontainsregex[il1]{2}mit.*ma[il1]{2} ?bo?x
regex.icontainsregex[il][il][il]egai[ -]
regex.icontainsregex[li][li][li]ega[li] attempt
regex.icontainsregex[ng]-?[io]n .*block
regex.icontainsregex[ng]-?[io]n .*cancel
regex.icontainsregex[ng]-?[io]n .*deactiv
regex.icontainsregex[ng]-?[io]n .*disabl
regex.icontainsregexaction.*required
regex.icontainsregexabandon.*package
regex.icontainsregexabout.your.account
regex.icontainsregexacc(ou)?n?t (is )?on ho[li]d
regex.icontainsregexacc(ou)?n?t.*terminat
regex.icontainsregexacc(oun)?t.*[il1]{2}mitation
regex.icontainsregexaccess.*limitation
regex.icontainsregexaccount (will be )?block
regex.icontainsregexaccount.*de-?activat
regex.icontainsregexaccount.*locked
regex.icontainsregexaccount.*re-verification
regex.icontainsregexaccount.*security
regex.icontainsregexaccount.*suspension
regex.icontainsregexaccount.has.been
regex.icontainsregexaccount.has.expired
regex.icontainsregexaccount.will.be.blocked
regex.icontainsregexaccount v[il]o[li]at
regex.icontainsregexactivity.*acc(oun)?t
regex.icontainsregexall.?staff
regex.icontainsregexalmost.full
regex.icontainsregexapp[li]e.[il]d
regex.icontainsregexauthenticate.*account
regex.icontainsregexbeen.*suspend
regex.icontainsregexbonus
regex.icontainsregexclos.*of.*account.*processed
regex.icontainsregexconfirm.your.account
regex.icontainsregexcourier.*able
regex.icontainsregexcrediential.*notif
regex.icontainsregexdeactivation.*in.*progress
regex.icontainsregexdelivery.*attempt.*failed
regex.icontainsregexdocument.received
regex.icontainsregexdocumented.*shared.*with.*you
regex.icontainsregexdropbox.*document
regex.icontainsregexe-?ma[il1]+ .{010}suspen
regex.icontainsregexe-?ma[il1]{1} user
regex.icontainsregexe-?ma[il1]{2} acc
regex.icontainsregexe-?ma[il1]{2}.*up.?grade
regex.icontainsregexe.?ma[il1]{2}.*server
regex.icontainsregexe.?ma[il1]{2}.*suspend
regex.icontainsregexemail.update
regex.icontainsregexfaxed you
regex.icontainsregexfraud(ulent)?.*charge
regex.icontainsregexfrom.helpdesk
regex.icontainsregexfu[il1]{2}.*ma[il1]+[ -]?box
regex.icontainsregexhas.been.*suspended
regex.icontainsregexhas.been.limited
regex.icontainsregexhave.locked
regex.icontainsregexhe[li]p ?desk upgrade
regex.icontainsregexheipdesk
regex.icontainsregexi[il]iega[il]
regex.icontainsregexii[il]ega[il]
regex.icontainsregexincoming e?mail
regex.icontainsregexincoming.*fax
regex.icontainsregexlock.*security
regex.icontainsregexma[il1]{1}[ -]?box.*quo
regex.icontainsregexma[il1]{2}[ -]?box.*fu[il1]
regex.icontainsregexma[il1]{2}box.*[il1]{2}mit
regex.icontainsregexma[il1]{2}box stor
regex.icontainsregexmail on.?hold
regex.icontainsregexmail.*box.*migration
regex.icontainsregexmail.*de-?activat
regex.icontainsregexmail.update.required
regex.icontainsregexmails.*pending
regex.icontainsregexmessages.*pending
regex.icontainsregexmissed.*shipping.*notification
regex.icontainsregexmissed.shipment.notification
regex.icontainsregexmust.update.your.account
regex.icontainsregexnew [sl][io]g?[nig][ -]?in from
regex.icontainsregexnew voice ?-?mail
regex.icontainsregexnotifications.*pending
regex.icontainsregexoffice.*3.*6.*5.*suspend
regex.icontainsregexoffice365
regex.icontainsregexon google docs with you
regex.icontainsregexonline doc
regex.icontainsregexpassword.*compromised
regex.icontainsregexpayment advice
regex.icontainsregexperiodic maintenance
regex.icontainsregexpotential(ly)? unauthorized
regex.icontainsregexrefund not approved
regex.icontainsregexreport
regex.icontainsregexrevised.*policy
regex.icontainsregexscam
regex.icontainsregexscanned.?invoice
regex.icontainsregexsecured?.update
regex.icontainsregexsecurity breach
regex.icontainsregexsecurlty
regex.icontainsregexseguranca
regex.icontainsregexsigned.*delivery
regex.icontainsregexstatus of your .{314}? ?delivery
regex.icontainsregexsusp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
regex.icontainsregexsuspicious.*sign.*[io]n
regex.icontainsregexsuspicious.activit
regex.icontainsregextemporar(il)?y deactivate
regex.icontainsregextemporar[il1]{2}y disab[li]ed
regex.icontainsregextemporarily.*lock
regex.icontainsregexun-?usua[li].activity
regex.icontainsregexunable.*deliver
regex.icontainsregexunauthorized.*activit
regex.icontainsregexunauthorized.device
regex.icontainsregexundelivered message
regex.icontainsregexunread.*doc
regex.icontainsregexunusual.activity
regex.icontainsregexupgrade.*account
regex.icontainsregexupgrade.notice
regex.icontainsregexurgent message
regex.icontainsregexurgent.verification
regex.icontainsregexv[il1]o[li1]at[il1]on security
regex.icontainsregexva[il1]{1}date.*ma[il1]{2}[ -]?box
regex.icontainsregexverification ?-?require
regex.icontainsregexverification( )?-?need
regex.icontainsregexverify.your?.account
regex.icontainsregexweb ?-?ma[il1]{2}
regex.icontainsregexweb[ -]?ma[il1]{2}
regex.icontainsregexwill.be.suspended
regex.icontainsregexyour (customer )?account .as
regex.icontainsregexyour.office.365
regex.icontainsregexyour.online.access
regex.icontainsregexAccounts.?Payable
regex.icontainsregexAdmin
regex.icontainsregexAdministrator
regex.icontainsregexAlert
regex.icontainsregexAssistant
regex.icontainsregexBilling
regex.icontainsregexBenefits
regex.icontainsregexBonus
regex.icontainsregexCEO
regex.icontainsregexCFO
regex.icontainsregexCIO
regex.icontainsregexCTO
regex.icontainsregexChairman
regex.icontainsregexClaim
regex.icontainsregexConfirm
regex.icontainsregexCritical
regex.icontainsregexCustomer Service
regex.icontainsregexDeal
regex.icontainsregexDiscount
regex.icontainsregexDirector
regex.icontainsregexExclusive
regex.icontainsregexExecutive
regex.icontainsregexFax
regex.icontainsregexFree
regex.icontainsregexGift
regex.icontainsregex/bHR/b
regex.icontainsregexHelpdesk
regex.icontainsregexHuman Resources
regex.icontainsregexImmediate
regex.icontainsregexImportant
regex.icontainsregexInfo
regex.icontainsregexInformation
regex.icontainsregexInvoice
regex.icontainsregex\bIT\b
regex.icontainsregexLegal
regex.icontainsregexLottery
regex.icontainsregexManagement
regex.icontainsregexManager
regex.icontainsregexMember Services
regex.icontainsregexNotification
regex.icontainsregexOffer
regex.icontainsregexOperations
regex.icontainsregexOrder
regex.icontainsregexPartner
regex.icontainsregexPayment
regex.icontainsregexPayroll
regex.icontainsregexPresident
regex.icontainsregexPremium
regex.icontainsregexPrize
regex.icontainsregexReceipt
regex.icontainsregexRefund
regex.icontainsregexRegistrar
regex.icontainsregexRequired
regex.icontainsregexReward
regex.icontainsregexSales
regex.icontainsregexSecretary
regex.icontainsregexSecurity
regex.icontainsregexService
regex.icontainsregexSignature
regex.icontainsregexStaffAnnouncement
regex.icontainsregexStorage
regex.icontainsregexSupport
regex.icontainsregexSweepstakes
regex.icontainsregexSystem
regex.icontainsregexTax
regex.icontainsregexTech Support
regex.icontainsregexUpdate
regex.icontainsregexUpgrade
regex.icontainsregexUrgent
regex.icontainsregexValidate
regex.icontainsregexVerify
regex.icontainsregexVIP
regex.icontainsregexWebmaster
regex.icontainsregexWinner
recipients.to[].display_nameequalsUndisclosed recipients