detection.wiki

Detection rules › Sublime MQL

Reconnaissance: Email address harvesting attempt

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects potential email harvesting or credential phishing attempts where short messages contain email addresses in the body text. These messages often try to extract contact information or validate email addresses for future attacks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Spam
Tactics and techniquesFree email provider, Social engineering

Event coverage

Message attribute
body.current_thread
sender.email
subject
type

Rule body MQL

type.inbound
and length(subject.base) <= 15
// detect email addresses in body text
and (
  regex.imatch(body.current_thread.text,
               '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
  )
)
// external freemail sender
and sender.email.domain.root_domain in $free_email_providers
// no attachments but allow one link
and length(attachments) == 0
and length(body.current_thread.links) == 1

Detection logic

Scope: inbound message.

Detects potential email harvesting or credential phishing attempts where short messages contain email addresses in the body text. These messages often try to extract contact information or validate email addresses for future attacks.

  1. inbound message
  2. length(subject.base) ≤ 15
  3. body.current_thread.text matches '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}'
  4. sender.email.domain.root_domain in $free_email_providers
  5. length(attachments) is 0
  6. length(body.current_thread.links) is 1

Inspects: body.current_thread.links, body.current_thread.text, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: regex.imatch. Reference lists: $free_email_providers.

Indicators matched (1)

FieldMatchValue
regex.imatchregex[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}