detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: salesforce

RuleSeverity
Salesforce infrastructure abusemedium

Salesforce infrastructure abuse

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Identifies messages that resemble credential theft, originating from Salesforce. Salesforce infrastrcture abuse has been observed recently to send phishing attacks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.current_thread
  • body.links
  • headers
  • headers.auth_summary
  • headers.hops
  • headers.return_path
  • recipients
  • recipients.to
  • sender.email
  • subject
  • type

Rule body

type.inbound

// we look at the return-path because many times in the abuse
// we've seen, the From is a custom domain
and headers.return_path.domain.root_domain == "salesforce.com"
and length(attachments) == 0
// there are external links (not org or SF domains)
and length(filter(body.links,
                  .href_url.domain.domain not in $org_domains
                  and .href_url.domain.root_domain not in (
                    "salesforce.com",
                    "force.com",
                    "site.com", // salesforce CRM
                    "agentforce.com"
                  )
           )
) > 0
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
    )
    and ml.nlu_classifier(body.current_thread.text).language == "english"
  )
  // subject match when cred_theft doesn't match
  // high confidence observed subject intros in the format of "Urgent Thing: ..."
  or regex.icontains(subject.subject,
                     '^(?:(?:Final|Last)?\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\s*:\s*'
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         .name in ("Facebook", "Meta", "Instagram", "Threads")
         and .confidence in ("medium", "high")
  )
  // any of the links are for newly registered domains
  or any(filter(body.links,
                .href_url.domain.domain not in $org_domains
                and .href_url.domain.root_domain not in (
                  "salesforce.com",
                  "force.com",
                  "site.com", // salesforce CRM
                  "agentforce.com"
                )
         ),
         network.whois(.href_url.domain).days_old < 30
  )
  // all links lead to a url shortener domain
  or (
    length(body.links) > 0
    and all(body.links, .href_url.domain.root_domain in $url_shorteners)
  )
)
and 1 of (
  ( // sender domain matches no body domains
    length(body.links) > 0
    and all(body.links,
            (
              .href_url.domain.root_domain != sender.email.domain.root_domain
              and .href_url.domain.root_domain not in (
                "salesforce.com",
                "force.com",
                "site.com",
                "agentforce.com"
              )
            )
            or .href_url.domain.root_domain is null
    )
  ),
  any(recipients.to,
      .email.domain.valid
      and any(body.links,
              strings.icontains(.href_url.url, ..email.email)
              or any(beta.scan_base64(.href_url.url,
                                      format="url",
                                      ignore_padding=true
                     ),
                     strings.icontains(., ...email.email)
              )
              or any(beta.scan_base64(.href_url.fragment, ignore_padding=true),
                     strings.icontains(., ...email.email)
              )
              // cloudflare turnstile or phishing warning page
              or strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
                                   "cloudflare"
              )
      )
  ),
  regex.icontains(subject.subject,
                  "termination.*notice",
                  "38417",
                  ":completed",
                  "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                  "[il][il][il]egai[ -]",
                  "[li][li][li]ega[li] attempt",
                  "[ng]-?[io]n .*block",
                  "[ng]-?[io]n .*cancel",
                  "[ng]-?[io]n .*deactiv",
                  "[ng]-?[io]n .*disabl",
                  "action.*required",
                  "abandon.*package",
                  "about.your.account",
                  "acc(ou)?n?t (is )?on ho[li]d",
                  "acc(ou)?n?t.*terminat",
                  "acc(oun)?t.*[il1]{2}mitation",
                  "access.*limitation",
                  "account (will be )?block",
                  "account.*de-?activat",
                  "account.*locked",
                  "account.*restrict",
                  "account.*re-verification",
                  "account.*security",
                  "account.*suspension",
                  "account.has.been",
                  "account.has.expired",
                  "account.will.be.blocked",
                  "account v[il]o[li]at",
                  "activity.*acc(oun)?t",
                  "almost.full",
                  "app[li]e.[il]d",
                  "appeal required",
                  "authenticate.*account",
                  "been.*suspend",
                  "clos.*of.*account.*processed",
                  "confirm.your.account",
                  "copyright (?:restriction|infringment)",
                  "courier.*able",
                  "crediential.*notif",
                  "Critical Alert",
                  "deactivation.*in.*progress",
                  "delivery.*attempt.*failed",
                  "document.received",
                  "documented.*shared.*with.*you",
                  "dropbox.*document",
                  "e-?ma[il1]+ .{010}suspen",
                  "e-?ma[il1]{1} user",
                  "e-?ma[il1]{2} acc",
                  "e-?ma[il1]{2}.*up.?grade",
                  "e.?ma[il1]{2}.*server",
                  "e.?ma[il1]{2}.*suspend",
                  "email.update",
                  "faxed you",
                  "final notice",
                  "fraud(ulent)?.*charge",
                  "from.helpdesk",
                  "fu[il1]{2}.*ma[il1]+[ -]?box",
                  "has.been.*suspended",
                  "has.been.limited",
                  "have.locked",
                  "he[li]p ?desk upgrade",
                  "heipdesk",
                  "i[il]iega[il]",
                  "ii[il]ega[il]",
                  "immediate action",
                  "incoming e?mail",
                  "incoming.*fax",
                  "lock.*security",
                  "ma[il1]{1}[ -]?box.*quo",
                  "ma[il1]{2}[ -]?box.*fu[il1]",
                  "ma[il1]{2}box.*[il1]{2}mit",
                  "ma[il1]{2}box stor",
                  "mail on.?hold",
                  "mail.*box.*migration",
                  "mail.*de-?activat",
                  "mail.update.required",
                  "mails.*pending",
                  "messages.*pending",
                  "missed.*shipping.*notification",
                  "missed.shipment.notification",
                  "must.update.your.account",
                  "new [sl][io]g?[nig][ -]?in from",
                  "new voice ?-?mail",
                  "notifications.*pending",
                  "office.*3.*6.*5.*suspend",
                  "office365",
                  "on google docs with you",
                  "online doc",
                  "password.*compromised",
                  "periodic maintenance",
                  "potential(ly)? unauthorized",
                  "refund not approved",
                  "restrictions applied",
                  "report",
                  "revised.*policy",
                  "scam",
                  "scanned.?invoice",
                  "secured?.update",
                  "security breach",
                  "securlty",
                  "signed.*delivery",
                  "social media",
                  "status of your .{314}? ?delivery",
                  "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                  "suspicious.*sign.*[io]n",
                  "suspicious.activit",
                  "temporar(il)?y deactivate",
                  "temporar[il1]{2}y disab[li]ed",
                  "temporarily.*lock",
                  "time.sensitive",
                  "un-?usua[li].activity",
                  "unable.*deliver",
                  "unauthorized.*activit",
                  "unauthorized.device",
                  "unauthorized.use",
                  "undelivered message",
                  "unread.*doc",
                  "unusual.activity",
                  "upgrade.*account",
                  "upgrade.notice",
                  "urgent message",
                  "urgent.verification",
                  "v[il1]o[li1]at[il1]on security",
                  "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                  "verification ?-?require",
                  "verification( )?-?need",
                  "verify.your?.account",
                  "web ?-?ma[il1]{2}",
                  "web[ -]?ma[il1]{2}",
                  "will.be.suspended",
                  "your (customer )?account .as",
                  "your.office.365",
                  "your.online.access",
                  "Critical.Notice",
                  "Restore.Access",
                  // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects.txt
                  "account has been limited",
                  "action required",
                  "almost full",
                  "apd notifi cation",
                  "are you at your desk",
                  "are you available",
                  "attached file to docusign",
                  "banking is temporarily unavailable",
                  "bankofamerica",
                  "closing statement invoice",
                  "completed: docusign",
                  "de-activation of",
                  "delivery attempt",
                  "delivery stopped for shipment",
                  "detected suspicious",
                  "detected suspicious actvity",
                  "docu sign",
                  "document for you",
                  "document has been sent to you via docusign",
                  "document is ready for signature",
                  "docusign",
                  "encrypted message",
                  "failed delivery",
                  "fedex tracking",
                  "file was shared",
                  "freefax",
                  "fwd: due invoice paid",
                  "has shared",
                  "inbox is full",
                  "invitation to comment",
                  "invitation to edit",
                  "invoice due",
                  "left you a message",
                  "message from",
                  "new message",
                  "new voicemail",
                  "on desk",
                  "out of space",
                  "password reset",
                  "payment status",
                  "quick reply",
                  "re: w-2",
                  "required",
                  "required: completed docusign",
                  "remittance",
                  "ringcentral",
                  "scanned image",
                  "secured files",
                  "secured pdf",
                  "security alert",
                  "new sign-in",
                  "new sign in",
                  "sign-in attempt",
                  "sign in attempt",
                  "staff review",
                  "suspicious activity",
                  "unrecognized login attempt",
                  "upgrade immediately",
                  "urgent",
                  "wants to share",
                  "w2",
                  "you have notifications pending",
                  "your account",
                  'your (?:\w+\s+){0,1}\s*account',
                  "your amazon order",
                  "your document settlement",
                  "your order with amazon",
                  "your password has been compromised",
  ),
  any($suspicious_subjects, strings.icontains(subject.subject, .))
)
and (
  // if the From is a custom domain, check that it's an unknown sender
  // otherwise, it should be from salesforce
  (
    sender.email.domain.domain == "salesforce.com"
    and any(headers.hops,
            any(.fields,
                .name == "X-SFDC-EmailCategory"
                and .value in (
                  "apiMassMail",
                  "networksNewUser",
                  "Not Specified"
                )
            )
    )
    // negate "meta" emails from the mentioned org itself
    // for example, subject: "a sandbox has been deleted for org ID, a1b2c3"
    // the org ID will appear in the X-SFDC-LK header
    and not any(headers.hops,
                any(.fields,
                    .name == "X-SFDC-LK"
                    and strings.ends_with(subject.subject, .value)
                )
    )
  )
  or (
    (
      (
        profile.by_sender().prevalence in ("new", "outlier")
        and not profile.by_sender().solicited
      )
      or (
        profile.by_sender().any_messages_malicious_or_spam
        and not profile.by_sender().any_messages_benign
      )
    )

    // negate highly trusted sender domains unless they fail DMARC authentication
    and (
      (
        sender.email.domain.root_domain in $high_trust_sender_root_domains
        and not headers.auth_summary.dmarc.pass
      )
      or sender.email.domain.root_domain not in $high_trust_sender_root_domains
    )
  )
)

Detection logic

Scope: inbound message.

Identifies messages that resemble credential theft, originating from Salesforce. Salesforce infrastrcture abuse has been observed recently to send phishing attacks.

  1. inbound message
  2. headers.return_path.domain.root_domain is 'salesforce.com'
  3. length(attachments) is 0
  4. length(filter(body.links, .href_url.domain.domain not in $org_domains and .href_url.domain.root_domain not in ('salesforce.com', 'force.com', 'site.com', 'agentforce.com'))) > 0
  5. any of:
    • all of:
      • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
        • .name is 'cred_theft'
        • .confidence is 'high'
      • ml.nlu_classifier(body.current_thread.text).language is 'english'
    • subject.subject matches '^(?:(?:Final|Last)?\\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\\s*:\\s*'
    • any of ml.logo_detect(file.message_screenshot()).brands where all hold:
      • .name in ('Facebook', 'Meta', 'Instagram', 'Threads')
      • .confidence in ('medium', 'high')
    • any of filter(body.links) where:
      • network.whois(.href_url.domain).days_old < 30
    • all of:
      • length(body.links) > 0
      • all of body.links where:
        • .href_url.domain.root_domain in $url_shorteners
  6. at least 1 of:
    • all of:
      • length(body.links) > 0
      • all of body.links where any holds:
        • all of:
          • .href_url.domain.root_domain is not sender.email.domain.root_domain
          • .href_url.domain.root_domain not in ('salesforce.com', 'force.com', 'site.com', 'agentforce.com')
        • .href_url.domain.root_domain is missing
    • any of recipients.to where all hold:
      • .email.domain.valid
      • any of body.links where any holds:
        • strings.icontains(.href_url.url)
        • any of beta.scan_base64(.href_url.url) where:
          • strings.icontains(.)
        • any of beta.scan_base64(.href_url.fragment) where:
          • strings.icontains(.)
        • ml.link_analysis(., mode='aggressive').final_dom.display_text contains 'cloudflare'
    • subject.subject matches any of 203 patterns
      • termination.*notice
      • 38417
      • :completed
      • [il1]{2}mit.*ma[il1]{2} ?bo?x
      • [il][il][il]egai[ -]
      • [li][li][li]ega[li] attempt
      • [ng]-?[io]n .*block
      • [ng]-?[io]n .*cancel
      • [ng]-?[io]n .*deactiv
      • [ng]-?[io]n .*disabl
      • action.*required
      • abandon.*package
      • about.your.account
      • acc(ou)?n?t (is )?on ho[li]d
      • acc(ou)?n?t.*terminat
      • acc(oun)?t.*[il1]{2}mitation
      • access.*limitation
      • account (will be )?block
      • account.*de-?activat
      • account.*locked
      • account.*restrict
      • account.*re-verification
      • account.*security
      • account.*suspension
      • account.has.been
      • account.has.expired
      • account.will.be.blocked
      • account v[il]o[li]at
      • activity.*acc(oun)?t
      • almost.full
      • app[li]e.[il]d
      • appeal required
      • authenticate.*account
      • been.*suspend
      • clos.*of.*account.*processed
      • confirm.your.account
      • copyright (?:restriction|infringment)
      • courier.*able
      • crediential.*notif
      • Critical Alert
      • deactivation.*in.*progress
      • delivery.*attempt.*failed
      • document.received
      • documented.*shared.*with.*you
      • dropbox.*document
      • e-?ma[il1]+ .{010}suspen
      • e-?ma[il1]{1} user
      • e-?ma[il1]{2} acc
      • e-?ma[il1]{2}.*up.?grade
      • e.?ma[il1]{2}.*server
      • e.?ma[il1]{2}.*suspend
      • email.update
      • faxed you
      • final notice
      • fraud(ulent)?.*charge
      • from.helpdesk
      • fu[il1]{2}.*ma[il1]+[ -]?box
      • has.been.*suspended
      • has.been.limited
      • have.locked
      • he[li]p ?desk upgrade
      • heipdesk
      • i[il]iega[il]
      • ii[il]ega[il]
      • immediate action
      • incoming e?mail
      • incoming.*fax
      • lock.*security
      • ma[il1]{1}[ -]?box.*quo
      • ma[il1]{2}[ -]?box.*fu[il1]
      • ma[il1]{2}box.*[il1]{2}mit
      • ma[il1]{2}box stor
      • mail on.?hold
      • mail.*box.*migration
      • mail.*de-?activat
      • mail.update.required
      • mails.*pending
      • messages.*pending
      • missed.*shipping.*notification
      • missed.shipment.notification
      • must.update.your.account
      • new [sl][io]g?[nig][ -]?in from
      • new voice ?-?mail
      • notifications.*pending
      • office.*3.*6.*5.*suspend
      • office365
      • on google docs with you
      • online doc
      • password.*compromised
      • periodic maintenance
      • potential(ly)? unauthorized
      • refund not approved
      • restrictions applied
      • report
      • revised.*policy
      • scam
      • scanned.?invoice
      • secured?.update
      • security breach
      • securlty
      • signed.*delivery
      • social media
      • status of your .{314}? ?delivery
      • susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
      • suspicious.*sign.*[io]n
      • suspicious.activit
      • temporar(il)?y deactivate
      • temporar[il1]{2}y disab[li]ed
      • temporarily.*lock
      • time.sensitive
      • un-?usua[li].activity
      • unable.*deliver
      • unauthorized.*activit
      • unauthorized.device
      • unauthorized.use
      • undelivered message
      • unread.*doc
      • unusual.activity
      • upgrade.*account
      • upgrade.notice
      • urgent message
      • urgent.verification
      • v[il1]o[li1]at[il1]on security
      • va[il1]{1}date.*ma[il1]{2}[ -]?box
      • verification ?-?require
      • verification( )?-?need
      • verify.your?.account
      • web ?-?ma[il1]{2}
      • web[ -]?ma[il1]{2}
      • will.be.suspended
      • your (customer )?account .as
      • your.office.365
      • your.online.access
      • Critical.Notice
      • Restore.Access
      • account has been limited
      • action required
      • almost full
      • apd notifi cation
      • are you at your desk
      • are you available
      • attached file to docusign
      • banking is temporarily unavailable
      • bankofamerica
      • closing statement invoice
      • completed: docusign
      • de-activation of
      • delivery attempt
      • delivery stopped for shipment
      • detected suspicious
      • detected suspicious actvity
      • docu sign
      • document for you
      • document has been sent to you via docusign
      • document is ready for signature
      • docusign
      • encrypted message
      • failed delivery
      • fedex tracking
      • file was shared
      • freefax
      • fwd: due invoice paid
      • has shared
      • inbox is full
      • invitation to comment
      • invitation to edit
      • invoice due
      • left you a message
      • message from
      • new message
      • new voicemail
      • on desk
      • out of space
      • password reset
      • payment status
      • quick reply
      • re: w-2
      • required
      • required: completed docusign
      • remittance
      • ringcentral
      • scanned image
      • secured files
      • secured pdf
      • security alert
      • new sign-in
      • new sign in
      • sign-in attempt
      • sign in attempt
      • staff review
      • suspicious activity
      • unrecognized login attempt
      • upgrade immediately
      • urgent
      • wants to share
      • w2
      • you have notifications pending
      • your account
      • your (?:\w+\s+){0,1}\s*account
      • your amazon order
      • your document settlement
      • your order with amazon
      • your password has been compromised
    • any of $suspicious_subjects where:
      • strings.icontains(subject.subject)
  7. any of:
    • all of:
      • sender.email.domain.domain is 'salesforce.com'
      • any of headers.hops where:
        • any of .fields where all hold:
          • .name is 'X-SFDC-EmailCategory'
          • .value in ('apiMassMail', 'networksNewUser', 'Not Specified')
      • not:
        • any of headers.hops where:
          • any of .fields where all hold:
            • .name is 'X-SFDC-LK'
            • strings.ends_with(subject.subject)
    • all of:
      • any of:
        • all of:
          • profile.by_sender().prevalence in ('new', 'outlier')
          • not:
            • profile.by_sender().solicited
        • all of:
          • profile.by_sender().any_messages_malicious_or_spam
          • not:
            • profile.by_sender().any_messages_benign
      • any of:
        • all of:
          • sender.email.domain.root_domain in $high_trust_sender_root_domains
          • not:
            • headers.auth_summary.dmarc.pass
        • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.fragment, body.links[].href_url.url, headers.auth_summary.dmarc.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.return_path.domain.root_domain, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, sender.email.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.scan_base64, file.message_screenshot, ml.link_analysis, ml.logo_detect, ml.nlu_classifier, network.whois, profile.by_sender, regex.icontains, strings.ends_with, strings.icontains. Reference lists: $high_trust_sender_root_domains, $org_domains, $suspicious_subjects, $url_shorteners.

Indicators matched (219)

FieldMatchValue
headers.return_path.domain.root_domainequalssalesforce.com
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
regex.icontainsregex^(?:(?:Final|Last)?\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\s*:\s*
ml.logo_detect(file.message_screenshot()).brands[].namememberFacebook
ml.logo_detect(file.message_screenshot()).brands[].namememberMeta
ml.logo_detect(file.message_screenshot()).brands[].namememberInstagram
ml.logo_detect(file.message_screenshot()).brands[].namememberThreads
ml.logo_detect(file.message_screenshot()).brands[].confidencemembermedium
ml.logo_detect(file.message_screenshot()).brands[].confidencememberhigh
strings.icontainssubstringcloudflare
regex.icontainsregextermination.*notice
207 more
regex.icontainsregex38417
regex.icontainsregex:completed
regex.icontainsregex[il1]{2}mit.*ma[il1]{2} ?bo?x
regex.icontainsregex[il][il][il]egai[ -]
regex.icontainsregex[li][li][li]ega[li] attempt
regex.icontainsregex[ng]-?[io]n .*block
regex.icontainsregex[ng]-?[io]n .*cancel
regex.icontainsregex[ng]-?[io]n .*deactiv
regex.icontainsregex[ng]-?[io]n .*disabl
regex.icontainsregexaction.*required
regex.icontainsregexabandon.*package
regex.icontainsregexabout.your.account
regex.icontainsregexacc(ou)?n?t (is )?on ho[li]d
regex.icontainsregexacc(ou)?n?t.*terminat
regex.icontainsregexacc(oun)?t.*[il1]{2}mitation
regex.icontainsregexaccess.*limitation
regex.icontainsregexaccount (will be )?block
regex.icontainsregexaccount.*de-?activat
regex.icontainsregexaccount.*locked
regex.icontainsregexaccount.*restrict
regex.icontainsregexaccount.*re-verification
regex.icontainsregexaccount.*security
regex.icontainsregexaccount.*suspension
regex.icontainsregexaccount.has.been
regex.icontainsregexaccount.has.expired
regex.icontainsregexaccount.will.be.blocked
regex.icontainsregexaccount v[il]o[li]at
regex.icontainsregexactivity.*acc(oun)?t
regex.icontainsregexalmost.full
regex.icontainsregexapp[li]e.[il]d
regex.icontainsregexappeal required
regex.icontainsregexauthenticate.*account
regex.icontainsregexbeen.*suspend
regex.icontainsregexclos.*of.*account.*processed
regex.icontainsregexconfirm.your.account
regex.icontainsregexcopyright (?:restriction|infringment)
regex.icontainsregexcourier.*able
regex.icontainsregexcrediential.*notif
regex.icontainsregexCritical Alert
regex.icontainsregexdeactivation.*in.*progress
regex.icontainsregexdelivery.*attempt.*failed
regex.icontainsregexdocument.received
regex.icontainsregexdocumented.*shared.*with.*you
regex.icontainsregexdropbox.*document
regex.icontainsregexe-?ma[il1]+ .{010}suspen
regex.icontainsregexe-?ma[il1]{1} user
regex.icontainsregexe-?ma[il1]{2} acc
regex.icontainsregexe-?ma[il1]{2}.*up.?grade
regex.icontainsregexe.?ma[il1]{2}.*server
regex.icontainsregexe.?ma[il1]{2}.*suspend
regex.icontainsregexemail.update
regex.icontainsregexfaxed you
regex.icontainsregexfinal notice
regex.icontainsregexfraud(ulent)?.*charge
regex.icontainsregexfrom.helpdesk
regex.icontainsregexfu[il1]{2}.*ma[il1]+[ -]?box
regex.icontainsregexhas.been.*suspended
regex.icontainsregexhas.been.limited
regex.icontainsregexhave.locked
regex.icontainsregexhe[li]p ?desk upgrade
regex.icontainsregexheipdesk
regex.icontainsregexi[il]iega[il]
regex.icontainsregexii[il]ega[il]
regex.icontainsregeximmediate action
regex.icontainsregexincoming e?mail
regex.icontainsregexincoming.*fax
regex.icontainsregexlock.*security
regex.icontainsregexma[il1]{1}[ -]?box.*quo
regex.icontainsregexma[il1]{2}[ -]?box.*fu[il1]
regex.icontainsregexma[il1]{2}box.*[il1]{2}mit
regex.icontainsregexma[il1]{2}box stor
regex.icontainsregexmail on.?hold
regex.icontainsregexmail.*box.*migration
regex.icontainsregexmail.*de-?activat
regex.icontainsregexmail.update.required
regex.icontainsregexmails.*pending
regex.icontainsregexmessages.*pending
regex.icontainsregexmissed.*shipping.*notification
regex.icontainsregexmissed.shipment.notification
regex.icontainsregexmust.update.your.account
regex.icontainsregexnew [sl][io]g?[nig][ -]?in from
regex.icontainsregexnew voice ?-?mail
regex.icontainsregexnotifications.*pending
regex.icontainsregexoffice.*3.*6.*5.*suspend
regex.icontainsregexoffice365
regex.icontainsregexon google docs with you
regex.icontainsregexonline doc
regex.icontainsregexpassword.*compromised
regex.icontainsregexperiodic maintenance
regex.icontainsregexpotential(ly)? unauthorized
regex.icontainsregexrefund not approved
regex.icontainsregexrestrictions applied
regex.icontainsregexreport
regex.icontainsregexrevised.*policy
regex.icontainsregexscam
regex.icontainsregexscanned.?invoice
regex.icontainsregexsecured?.update
regex.icontainsregexsecurity breach
regex.icontainsregexsecurlty
regex.icontainsregexsigned.*delivery
regex.icontainsregexsocial media
regex.icontainsregexstatus of your .{314}? ?delivery
regex.icontainsregexsusp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
regex.icontainsregexsuspicious.*sign.*[io]n
regex.icontainsregexsuspicious.activit
regex.icontainsregextemporar(il)?y deactivate
regex.icontainsregextemporar[il1]{2}y disab[li]ed
regex.icontainsregextemporarily.*lock
regex.icontainsregextime.sensitive
regex.icontainsregexun-?usua[li].activity
regex.icontainsregexunable.*deliver
regex.icontainsregexunauthorized.*activit
regex.icontainsregexunauthorized.device
regex.icontainsregexunauthorized.use
regex.icontainsregexundelivered message
regex.icontainsregexunread.*doc
regex.icontainsregexunusual.activity
regex.icontainsregexupgrade.*account
regex.icontainsregexupgrade.notice
regex.icontainsregexurgent message
regex.icontainsregexurgent.verification
regex.icontainsregexv[il1]o[li1]at[il1]on security
regex.icontainsregexva[il1]{1}date.*ma[il1]{2}[ -]?box
regex.icontainsregexverification ?-?require
regex.icontainsregexverification( )?-?need
regex.icontainsregexverify.your?.account
regex.icontainsregexweb ?-?ma[il1]{2}
regex.icontainsregexweb[ -]?ma[il1]{2}
regex.icontainsregexwill.be.suspended
regex.icontainsregexyour (customer )?account .as
regex.icontainsregexyour.office.365
regex.icontainsregexyour.online.access
regex.icontainsregexCritical.Notice
regex.icontainsregexRestore.Access
regex.icontainsregexaccount has been limited
regex.icontainsregexaction required
regex.icontainsregexalmost full
regex.icontainsregexapd notifi cation
regex.icontainsregexare you at your desk
regex.icontainsregexare you available
regex.icontainsregexattached file to docusign
regex.icontainsregexbanking is temporarily unavailable
regex.icontainsregexbankofamerica
regex.icontainsregexclosing statement invoice
regex.icontainsregexcompleted: docusign
regex.icontainsregexde-activation of
regex.icontainsregexdelivery attempt
regex.icontainsregexdelivery stopped for shipment
regex.icontainsregexdetected suspicious
regex.icontainsregexdetected suspicious actvity
regex.icontainsregexdocu sign
regex.icontainsregexdocument for you
regex.icontainsregexdocument has been sent to you via docusign
regex.icontainsregexdocument is ready for signature
regex.icontainsregexdocusign
regex.icontainsregexencrypted message
regex.icontainsregexfailed delivery
regex.icontainsregexfedex tracking
regex.icontainsregexfile was shared
regex.icontainsregexfreefax
regex.icontainsregexfwd: due invoice paid
regex.icontainsregexhas shared
regex.icontainsregexinbox is full
regex.icontainsregexinvitation to comment
regex.icontainsregexinvitation to edit
regex.icontainsregexinvoice due
regex.icontainsregexleft you a message
regex.icontainsregexmessage from
regex.icontainsregexnew message
regex.icontainsregexnew voicemail
regex.icontainsregexon desk
regex.icontainsregexout of space
regex.icontainsregexpassword reset
regex.icontainsregexpayment status
regex.icontainsregexquick reply
regex.icontainsregexre: w-2
regex.icontainsregexrequired
regex.icontainsregexrequired: completed docusign
regex.icontainsregexremittance
regex.icontainsregexringcentral
regex.icontainsregexscanned image
regex.icontainsregexsecured files
regex.icontainsregexsecured pdf
regex.icontainsregexsecurity alert
regex.icontainsregexnew sign-in
regex.icontainsregexnew sign in
regex.icontainsregexsign-in attempt
regex.icontainsregexsign in attempt
regex.icontainsregexstaff review
regex.icontainsregexsuspicious activity
regex.icontainsregexunrecognized login attempt
regex.icontainsregexupgrade immediately
regex.icontainsregexurgent
regex.icontainsregexwants to share
regex.icontainsregexw2
regex.icontainsregexyou have notifications pending
regex.icontainsregexyour account
regex.icontainsregexyour (?:\w+\s+){0,1}\s*account
regex.icontainsregexyour amazon order
regex.icontainsregexyour document settlement
regex.icontainsregexyour order with amazon
regex.icontainsregexyour password has been compromised
sender.email.domain.domainequalssalesforce.com
headers.hops[].fields[].nameequalsX-SFDC-EmailCategory
headers.hops[].fields[].valuememberapiMassMail
headers.hops[].fields[].valuemembernetworksNewUser
headers.hops[].fields[].valuememberNot Specified

Stages and Predicates

Stage 1: mql_rule

and
  or
    and
      not
        any(headers.hops)
          any(headers.hops.fields)
            and
              headers.hops.fields[].name eq "X-SFDC-LK"
              strings.ends_with func_call "strings.ends_with(subject.subject)"
      any(headers.hops)
        any(headers.hops.fields)
          and
            headers.hops.fields[].name eq "X-SFDC-EmailCategory"
            headers.hops.fields[].value in ["Not Specified", "apiMassMail", "networksNewUser"]
      sender.email.domain.domain eq "salesforce.com"
    and
      or
        and
          not
            headers.auth_summary.dmarc.pass eq "true"
           macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
         macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
      or
        and
          not
            profile.by_sender func_call "profile.by_sender().any_messages_benign"
          profile.by_sender func_call "profile.by_sender().any_messages_malicious_or_spam"
        and
          not
            profile.by_sender func_call "profile.by_sender().solicited"
          profile.by_sender func_call "profile.by_sender().prevalence in (new, outlier)"
  or
    any(recipients.to)
      and
        any(body.links)
          or
            any(beta.scan_base64(body.links.href_url.fragment))
              strings.icontains func_call "strings.icontains(beta.scan_base64(body.links[].href_url.fragment)[])"
            any(beta.scan_base64(body.links.href_url.url))
              strings.icontains func_call "strings.icontains(beta.scan_base64(body.links[].href_url.url)[])"
            ml.link_analysis(body.links[], mode='aggressive').final_dom.display_text contains "cloudflare"
            strings.icontains func_call "strings.icontains(body.links[].href_url.url)"
        recipients.to.email.domain.valid eq "true"
    and
      body.links length_compare "0"
       macro "all(body.links)"
    any($suspicious_subjects)
      strings.icontains func_call "strings.icontains(subject.subject)"
    subject.subject regex_match "38417"
    subject.subject regex_match ":completed"
    subject.subject regex_match "Critical Alert"
    subject.subject regex_match "Critical.Notice"
    subject.subject regex_match "Restore.Access"
    subject.subject regex_match "[il1]{2}mit.*ma[il1]{2} ?bo?x"
    subject.subject regex_match "[il][il][il]egai[ -]"
    subject.subject regex_match "[li][li][li]ega[li] attempt"
    subject.subject regex_match "[ng]-?[io]n .*block"
    subject.subject regex_match "[ng]-?[io]n .*cancel"
    subject.subject regex_match "[ng]-?[io]n .*deactiv"
    subject.subject regex_match "[ng]-?[io]n .*disabl"
    subject.subject regex_match "abandon.*package"
    subject.subject regex_match "about.your.account"
    subject.subject regex_match "acc(ou)?n?t (is )?on ho[li]d"
    subject.subject regex_match "acc(ou)?n?t.*terminat"
    subject.subject regex_match "acc(oun)?t.*[il1]{2}mitation"
    subject.subject regex_match "access.*limitation"
    subject.subject regex_match "account (will be )?block"
    subject.subject regex_match "account has been limited"
    subject.subject regex_match "account v[il]o[li]at"
    subject.subject regex_match "account.*de-?activat"
    subject.subject regex_match "account.*locked"
    subject.subject regex_match "account.*re-verification"
    subject.subject regex_match "account.*restrict"
    subject.subject regex_match "account.*security"
    subject.subject regex_match "account.*suspension"
    subject.subject regex_match "account.has.been"
    subject.subject regex_match "account.has.expired"
    subject.subject regex_match "account.will.be.blocked"
    subject.subject regex_match "action required"
    subject.subject regex_match "action.*required"
    subject.subject regex_match "activity.*acc(oun)?t"
    subject.subject regex_match "almost full"
    subject.subject regex_match "almost.full"
    subject.subject regex_match "apd notifi cation"
    subject.subject regex_match "app[li]e.[il]d"
    subject.subject regex_match "appeal required"
    subject.subject regex_match "are you at your desk"
    subject.subject regex_match "are you available"
    subject.subject regex_match "attached file to docusign"
    subject.subject regex_match "authenticate.*account"
    subject.subject regex_match "banking is temporarily unavailable"
    subject.subject regex_match "bankofamerica"
    subject.subject regex_match "been.*suspend"
    subject.subject regex_match "clos.*of.*account.*processed"
    subject.subject regex_match "closing statement invoice"
    subject.subject regex_match "completed: docusign"
    subject.subject regex_match "confirm.your.account"
    subject.subject regex_match "copyright (?:restriction|infringment)"
    subject.subject regex_match "courier.*able"
    subject.subject regex_match "crediential.*notif"
    subject.subject regex_match "de-activation of"
    subject.subject regex_match "deactivation.*in.*progress"
    subject.subject regex_match "delivery attempt"
    subject.subject regex_match "delivery stopped for shipment"
    subject.subject regex_match "delivery.*attempt.*failed"
    subject.subject regex_match "detected suspicious actvity"
    subject.subject regex_match "detected suspicious"
    subject.subject regex_match "docu sign"
    subject.subject regex_match "document for you"
    subject.subject regex_match "document has been sent to you via docusign"
    subject.subject regex_match "document is ready for signature"
    subject.subject regex_match "document.received"
    subject.subject regex_match "documented.*shared.*with.*you"
    subject.subject regex_match "docusign"
    subject.subject regex_match "dropbox.*document"
    subject.subject regex_match "e-?ma[il1]+ .{010}suspen"
    subject.subject regex_match "e-?ma[il1]{1} user"
    subject.subject regex_match "e-?ma[il1]{2} acc"
    subject.subject regex_match "e-?ma[il1]{2}.*up.?grade"
    subject.subject regex_match "e.?ma[il1]{2}.*server"
    subject.subject regex_match "e.?ma[il1]{2}.*suspend"
    subject.subject regex_match "email.update"
    subject.subject regex_match "encrypted message"
    subject.subject regex_match "failed delivery"
    subject.subject regex_match "faxed you"
    subject.subject regex_match "fedex tracking"
    subject.subject regex_match "file was shared"
    subject.subject regex_match "final notice"
    subject.subject regex_match "fraud(ulent)?.*charge"
    subject.subject regex_match "freefax"
    subject.subject regex_match "from.helpdesk"
    subject.subject regex_match "fu[il1]{2}.*ma[il1]+[ -]?box"
    subject.subject regex_match "fwd: due invoice paid"
    subject.subject regex_match "has shared"
    subject.subject regex_match "has.been.*suspended"
    subject.subject regex_match "has.been.limited"
    subject.subject regex_match "have.locked"
    subject.subject regex_match "he[li]p ?desk upgrade"
    subject.subject regex_match "heipdesk"
    subject.subject regex_match "i[il]iega[il]"
    subject.subject regex_match "ii[il]ega[il]"
    subject.subject regex_match "immediate action"
    subject.subject regex_match "inbox is full"
    subject.subject regex_match "incoming e?mail"
    subject.subject regex_match "incoming.*fax"
    subject.subject regex_match "invitation to comment"
    subject.subject regex_match "invitation to edit"
    subject.subject regex_match "invoice due"
    subject.subject regex_match "left you a message"
    subject.subject regex_match "lock.*security"
    subject.subject regex_match "ma[il1]{1}[ -]?box.*quo"
    subject.subject regex_match "ma[il1]{2}[ -]?box.*fu[il1]"
    subject.subject regex_match "ma[il1]{2}box stor"
    subject.subject regex_match "ma[il1]{2}box.*[il1]{2}mit"
    subject.subject regex_match "mail on.?hold"
    subject.subject regex_match "mail.*box.*migration"
    subject.subject regex_match "mail.*de-?activat"
    subject.subject regex_match "mail.update.required"
    subject.subject regex_match "mails.*pending"
    subject.subject regex_match "message from"
    subject.subject regex_match "messages.*pending"
    subject.subject regex_match "missed.*shipping.*notification"
    subject.subject regex_match "missed.shipment.notification"
    subject.subject regex_match "must.update.your.account"
    subject.subject regex_match "new [sl][io]g?[nig][ -]?in from"
    subject.subject regex_match "new message"
    subject.subject regex_match "new sign in"
    subject.subject regex_match "new sign-in"
    subject.subject regex_match "new voice ?-?mail"
    subject.subject regex_match "new voicemail"
    subject.subject regex_match "notifications.*pending"
    subject.subject regex_match "office.*3.*6.*5.*suspend"
    subject.subject regex_match "office365"
    subject.subject regex_match "on desk"
    subject.subject regex_match "on google docs with you"
    subject.subject regex_match "online doc"
    subject.subject regex_match "out of space"
    subject.subject regex_match "password reset"
    subject.subject regex_match "password.*compromised"
    subject.subject regex_match "payment status"
    subject.subject regex_match "periodic maintenance"
    subject.subject regex_match "potential(ly)? unauthorized"
    subject.subject regex_match "quick reply"
    subject.subject regex_match "re: w-2"
    subject.subject regex_match "refund not approved"
    subject.subject regex_match "remittance"
    subject.subject regex_match "report"
    subject.subject regex_match "required"
    subject.subject regex_match "required: completed docusign"
    subject.subject regex_match "restrictions applied"
    subject.subject regex_match "revised.*policy"
    subject.subject regex_match "ringcentral"
    subject.subject regex_match "scam"
    subject.subject regex_match "scanned image"
    subject.subject regex_match "scanned.?invoice"
    subject.subject regex_match "secured files"
    subject.subject regex_match "secured pdf"
    subject.subject regex_match "secured?.update"
    subject.subject regex_match "security alert"
    subject.subject regex_match "security breach"
    subject.subject regex_match "securlty"
    subject.subject regex_match "sign in attempt"
    subject.subject regex_match "sign-in attempt"
    subject.subject regex_match "signed.*delivery"
    subject.subject regex_match "social media"
    subject.subject regex_match "staff review"
    subject.subject regex_match "status of your .{314}? ?delivery"
    subject.subject regex_match "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty"
    subject.subject regex_match "suspicious activity"
    subject.subject regex_match "suspicious.*sign.*[io]n"
    subject.subject regex_match "suspicious.activit"
    subject.subject regex_match "temporar(il)?y deactivate"
    subject.subject regex_match "temporar[il1]{2}y disab[li]ed"
    subject.subject regex_match "temporarily.*lock"
    subject.subject regex_match "termination.*notice"
    subject.subject regex_match "time.sensitive"
    subject.subject regex_match "un-?usua[li].activity"
    subject.subject regex_match "unable.*deliver"
    subject.subject regex_match "unauthorized.*activit"
    subject.subject regex_match "unauthorized.device"
    subject.subject regex_match "unauthorized.use"
    subject.subject regex_match "undelivered message"
    subject.subject regex_match "unread.*doc"
    subject.subject regex_match "unrecognized login attempt"
    subject.subject regex_match "unusual.activity"
    subject.subject regex_match "upgrade immediately"
    subject.subject regex_match "upgrade.*account"
    subject.subject regex_match "upgrade.notice"
    subject.subject regex_match "urgent message"
    subject.subject regex_match "urgent"
    subject.subject regex_match "urgent.verification"
    subject.subject regex_match "v[il1]o[li1]at[il1]on security"
    subject.subject regex_match "va[il1]{1}date.*ma[il1]{2}[ -]?box"
    subject.subject regex_match "verification ?-?require"
    subject.subject regex_match "verification( )?-?need"
    subject.subject regex_match "verify.your?.account"
    subject.subject regex_match "w2"
    subject.subject regex_match "wants to share"
    subject.subject regex_match "web ?-?ma[il1]{2}"
    subject.subject regex_match "web[ -]?ma[il1]{2}"
    subject.subject regex_match "will.be.suspended"
    subject.subject regex_match "you have notifications pending"
    subject.subject regex_match "your (?:\\w+\\s+){0,1}\\s*account"
    subject.subject regex_match "your (customer )?account .as"
    subject.subject regex_match "your account"
    subject.subject regex_match "your amazon order"
    subject.subject regex_match "your document settlement"
    subject.subject regex_match "your order with amazon"
    subject.subject regex_match "your password has been compromised"
    subject.subject regex_match "your.office.365"
    subject.subject regex_match "your.online.access"
  or
    and
      any(ml.nlu_classifier(body.current_thread.text).intents)
        and
          ml.nlu_classifier(body.current_thread.text).intents.confidence eq "high"
          ml.nlu_classifier(body.current_thread.text).intents.name eq "cred_theft"
      ml.nlu_classifier func_call "ml.nlu_classifier(body.current_thread.text).language == english"
    any(ml.logo_detect(file.message_screenshot()).brands)
      and
        ml.logo_detect(file.message_screenshot()).brands.confidence in ["high", "medium"]
        ml.logo_detect(file.message_screenshot()).brands.name in ["Facebook", "Instagram", "Meta", "Threads"]
    and
      body.links length_compare "0"
       macro "all(body.links)"
    any(filter(body.links))
      network.whois func_call "network.whois(filter(body.links)[].href_url.domain).days_old < 30"
    subject.subject regex_match "^(?:(?:Final|Last)?\\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\\s*:\\s*"
  attachments length_compare "0"
  filter(body.links, .href_url.domain.domain not in $org_domains and .href_url.domain.root_domain not in ('salesforce.com', 'force.com', 'site.com', 'agentforce.com')) length_compare "0"
  headers.return_path.domain.root_domain eq "salesforce.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
headers.return_path.domain.root_domaineq
  • salesforce.com
field:"headers.return_path.domain.root_domain" kind:eq value:"salesforce.com"
sender.email.domain.domaineq
  • salesforce.com
field:"sender.email.domain.domain" kind:eq value:"salesforce.com"
subject.subjectregex_match
  • 38417
  • :completed
  • Critical Alert
  • Critical.Notice
  • Restore.Access
  • [il1]{2}mit.*ma[il1]{2} ?bo?x
  • [il][il][il]egai[ -]
  • [li][li][li]ega[li] attempt
  • [ng]-?[io]n .*block
  • [ng]-?[io]n .*cancel
  • [ng]-?[io]n .*deactiv
  • [ng]-?[io]n .*disabl
  • ^(?:(?:Final|Last)?\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\s*:\s*
  • abandon.*package
  • about.your.account
  • acc(ou)?n?t (is )?on ho[li]d
  • acc(ou)?n?t.*terminat
  • acc(oun)?t.*[il1]{2}mitation
  • access.*limitation
  • account (will be )?block
  • account has been limited
  • account v[il]o[li]at
  • account.*de-?activat
  • account.*locked
  • account.*re-verification
  • account.*restrict
  • account.*security
  • account.*suspension
  • account.has.been
  • account.has.expired
  • account.will.be.blocked
  • action required
  • action.*required
  • activity.*acc(oun)?t
  • almost full
  • almost.full
  • apd notifi cation
  • app[li]e.[il]d
  • appeal required
  • are you at your desk
  • +164 more values (see full rule source)
field:"subject.subject" kind:regex_match
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"