Detection rules › Sublime MQL
Suspicious recipients pattern with NLU credential theft indicators
Detects messages with undisclosed recipients (likely all bcc) and NLU identified a credential theft intent with medium to high confidence from a suspicious low reputation link domain
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
and (
length(recipients.to) == 0
or all(recipients.to, strings.ilike(.display_name, "undisclosed?recipients"))
)
and length(recipients.cc) == 0
and 0 <= length(recipients.bcc) <= 1
and any(body.links, .href_url.domain.root_domain not in $tranco_1m)
and (
any(body.links,
regex.icontains(.display_text,
'(view|click|download|goto)?(attachment|download|file|online|document)s?'
)
or all(body.links, regex.match(.display_text, "[A-Z ]+"))
)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft") and .confidence in ("medium", "high")
)
Detection logic
Scope: inbound message.
Detects messages with undisclosed recipients (likely all bcc) and NLU identified a credential theft intent with medium to high confidence from a suspicious low reputation link domain
- inbound message
any of:
- length(recipients.to) is 0
all of
recipients.towhere:- .display_name matches 'undisclosed?recipients'
- length(recipients.cc) is 0
all of:
- length(recipients.bcc) ≥ 0
- length(recipients.bcc) ≤ 1
any of
body.linkswhere:- .href_url.domain.root_domain not in $tranco_1m
any of
body.linkswhere any holds:- .display_text matches '(view|click|download|goto)?(attachment|download|file|online|document)s?'
all of
body.linkswhere:- .display_text matches '[A-Z ]+'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('cred_theft')
- .confidence in ('medium', 'high')
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, regex.match, strings.ilike. Reference lists: $tranco_1m.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | undisclosed?recipients |
regex.icontains | regex | (view|click|download|goto)?(attachment|download|file|online|document)s? |
regex.match | regex | [A-Z ]+ |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | medium |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | high |