Detection rules › Sublime MQL
Reconnaissance: Hotel booking reply-to redirect
Detects messages impersonating hotel booking inquiries by identifying common hotel-related language patterns from senders where the reply-to is a free email provider and differs from the sender domain in an effort to validate whether a recipient address is valid or not, potentially preceding an attack.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(headers.reply_to,
.email.domain.root_domain in $free_email_providers
and .email.domain.root_domain != sender.email.domain.root_domain
)
and all(recipients.to,
.email.domain.root_domain != sender.email.domain.root_domain
)
and length(body.links) == 0
and length(attachments) == 0
and length(body.current_thread.text) < 600
and not (
(subject.is_reply or subject.is_forward)
and (length(headers.references) > 0 or headers.in_reply_to is not null)
)
and (
(
strings.ilike(body.current_thread.text,
'*hotel*',
'*your property*',
'*accommodation*',
'*guest services*',
'*reception*',
'*front desk*'
)
and strings.ilike(body.current_thread.text,
'*booking*',
'*to book*',
'*book a *',
'*reserv*',
'*room*',
'*suite*',
'*availability*',
'*check-in*',
'*available dates*',
'*family trip*',
'*deluxe accommodation*',
'*two children*',
'*hotel manager*'
)
)
or strings.ilike(subject.base,
'*hotel*',
'*room reserv*',
'*room inquiry*',
'*room availability*',
'*suite*',
'*accommodation*'
)
)
Detection logic
Scope: inbound message.
Detects messages impersonating hotel booking inquiries by identifying common hotel-related language patterns from senders where the reply-to is a free email provider and differs from the sender domain in an effort to validate whether a recipient address is valid or not, potentially preceding an attack.
- inbound message
any of
headers.reply_towhere all hold:- .email.domain.root_domain in $free_email_providers
- .email.domain.root_domain is not sender.email.domain.root_domain
all of
recipients.towhere:- .email.domain.root_domain is not sender.email.domain.root_domain
- length(body.links) is 0
- length(attachments) is 0
- length(body.current_thread.text) < 600
not:
all of:
any of:
- subject.is_reply
- subject.is_forward
any of:
- length(headers.references) > 0
- headers.in_reply_to is set
any of:
all of:
body.current_thread.text matches any of 6 patterns
*hotel**your property**accommodation**guest services**reception**front desk*
body.current_thread.text matches any of 13 patterns
*booking**to book**book a **reserv**room**suite**availability**check-in**available dates**family trip**deluxe accommodation**two children**hotel manager*
subject.base matches any of 6 patterns
*hotel**room reserv**room inquiry**room availability**suite**accommodation*
Inspects: body.current_thread.text, body.links, headers.in_reply_to, headers.references, headers.reply_to, headers.reply_to[].email.domain.root_domain, recipients.to, recipients.to[].email.domain.root_domain, sender.email.domain.root_domain, subject.base, subject.is_forward, subject.is_reply, type.inbound. Sensors: strings.ilike. Reference lists: $free_email_providers.
Indicators matched (22)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *hotel* |
strings.ilike | substring | *your property* |
strings.ilike | substring | *accommodation* |
strings.ilike | substring | *guest services* |
strings.ilike | substring | *reception* |
strings.ilike | substring | *front desk* |
strings.ilike | substring | *booking* |
strings.ilike | substring | *to book* |
strings.ilike | substring | *book a * |
strings.ilike | substring | *reserv* |
strings.ilike | substring | *room* |
strings.ilike | substring | *suite* |
10 more
strings.ilike | substring | *availability* |
strings.ilike | substring | *check-in* |
strings.ilike | substring | *available dates* |
strings.ilike | substring | *family trip* |
strings.ilike | substring | *deluxe accommodation* |
strings.ilike | substring | *two children* |
strings.ilike | substring | *hotel manager* |
strings.ilike | substring | *room reserv* |
strings.ilike | substring | *room inquiry* |
strings.ilike | substring | *room availability* |