detection.wiki

Detection rules › Sublime MQL

Reconnaissance: Empty subject with mismatched reply-to from new sender

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Message with no subject line from a new sender where the reply-to address differs from the sender address, potentially indicating header manipulation or impersonation tactics.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering, Spoofing

Event coverage

Message attribute
headers (collection)
headers.reply_to (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and profile.by_sender_email().prevalence == "new"
and subject.base == ""
and length(headers.reply_to) > 0
and sender.email.email not in map(headers.reply_to, .email.email)

Detection logic

Scope: inbound message.

Message with no subject line from a new sender where the reply-to address differs from the sender address, potentially indicating header manipulation or impersonation tactics.

  1. inbound message
  2. profile.by_sender_email().prevalence is 'new'
  3. subject.base is ''
  4. length(headers.reply_to) > 0
  5. sender.email.email not in map(headers.reply_to, .email.email)

Inspects: headers.reply_to, headers.reply_to[].email.email, sender.email.email, subject.base, type.inbound. Sensors: profile.by_sender_email.

Indicators matched (1)

FieldMatchValue
subject.baseequals