Detection rules › Sublime MQL

Sublime MQL rules: recruitee

Rule	Severity
Recruitee Infrastructure Abuse	`high`

Recruitee Infrastructure Abuse

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Identifies inbound messages from Recruitee domains containing recruitment-related topics and application links, where the sender has limited prior history. The URLs in these messages either point to recently registered domains or appear as standalone links with application-focused text.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud, Credential Phishing
Tactics and techniques	Impersonation: Brand, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.links
sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain == "recruitee.com"
and any(beta.ml_topic(body.current_thread.text).topics,
        .name in (
          "Advertising and Promotions",
          "Professional and Career Development"
        )
        and .confidence != "low"
)
and any(body.links,
        (
          network.whois(.href_url.domain).days_old < 30
          or length(body.links) == 1
        )
        and regex.icontains(.display_text, "apply|submit")
)
// use sender email, not domain, to ensure new *.recruitee.com addresses are correctly identified
and profile.by_sender_email().prevalence in ("new", "outlier")
and not profile.by_sender_email().any_messages_benign

Detection logic

Scope: inbound message.

inbound message
sender.email.domain.root_domain is 'recruitee.com'
any of beta.ml_topic(body.current_thread.text).topics where all hold:
- .name in ('Advertising and Promotions', 'Professional and Career Development')
- .confidence is not 'low'
any of body.links where all hold:
- any of:
  - network.whois(.href_url.domain).days_old < 30
  - length(body.links) is 1
- .display_text matches 'apply|submit'
profile.by_sender_email().prevalence in ('new', 'outlier')
not:
- profile.by_sender_email().any_messages_benign

Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain, sender.email.domain.root_domain, type.inbound. Sensors: beta.ml_topic, network.whois, profile.by_sender_email, regex.icontains.

Indicators matched (4)

Field	Match	Value
`sender.email.domain.root_domain`	equals	`recruitee.com`
`beta.ml_topic(body.current_thread.text).topics[].name`	member	`Advertising and Promotions`
`beta.ml_topic(body.current_thread.text).topics[].name`	member	`Professional and Career Development`
`regex.icontains`	regex	`apply\|submit`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(body.links)
    and
      or
        body.links length_compare "1"
        network.whois func_call "network.whois(body.links[].href_url.domain).days_old < 30"
      body.links.display_text regex_match "apply|submit"
  any(beta.ml_topic(body.current_thread.text).topics)
    and
      beta.ml_topic(body.current_thread.text).topics.confidence ne "low"
      beta.ml_topic(body.current_thread.text).topics.name in ["Advertising and Promotions", "Professional and Career Development"]
  not
    profile.by_sender_email func_call "profile.by_sender_email().any_messages_benign"
  profile.by_sender_email func_call "profile.by_sender_email().prevalence in (new, outlier)"
  sender.email.domain.root_domain eq "recruitee.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`sender.email.domain.root_domain`	eq	`recruitee.com`	`field:"sender.email.domain.root_domain" kind:eq value:"recruitee.com"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`