Detection rules › Sublime MQL

Reconnaissance: Empty message from uncommon sender

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects incoming messages that are completely empty, containing no subject line, message body content, or file attachments. Such messages may be used for reconnaissance, delivery confirmation, or as part of multi-stage attacks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and subject.base == ""
and (
  body.plain.raw is null
  or body.plain.raw == ""
  or regex.imatch(body.plain.raw, '^\s*$')
)
and (
  body.html.raw is null
  or body.html.raw == ""
  or regex.imatch(body.html.raw, '^\s*$')
)
and length(attachments) == 0
and profile.by_sender().prevalence != "common"

Detection logic

Scope: inbound message.

Detects incoming messages that are completely empty, containing no subject line, message body content, or file attachments. Such messages may be used for reconnaissance, delivery confirmation, or as part of multi-stage attacks.

  1. inbound message
  2. subject.base is ''
  3. any of:
    • body.plain.raw is missing
    • body.plain.raw is ''
    • body.plain.raw matches '^\\s*$'
  4. any of:
    • body.html.raw is missing
    • body.html.raw is ''
    • body.html.raw matches '^\\s*$'
  5. length(attachments) is 0
  6. profile.by_sender().prevalence is not 'common'

Inspects: body.html.raw, body.plain.raw, subject.base, type.inbound. Sensors: profile.by_sender, regex.imatch.

Indicators matched (4)

FieldMatchValue
subject.baseequals
body.plain.rawequals
regex.imatchregex^\s*$
body.html.rawequals