Detection rules › Sublime MQL
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content
Detects messages sent to self or invalid domains containing credential theft content that bypass Microsoft's CompAuth while failing both SPF and DMARC authentication checks.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Spoofing, Evasion |
Event coverage
Rule body MQL
type.inbound
// self sender
and length(recipients.to) == 1
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
)
// cred theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
// microsoft compauth pass, but spf and dmarc fail
and any(headers.hops, any(.fields, strings.icontains(.value, 'compauth=pass')))
and not coalesce(headers.auth_summary.dmarc.pass, false)
and not coalesce(headers.auth_summary.spf.pass, false)
Detection logic
Scope: inbound message.
Detects messages sent to self or invalid domains containing credential theft content that bypass Microsoft's CompAuth while failing both SPF and DMARC authentication checks.
- inbound message
- length(recipients.to) is 1
- length(recipients.cc) is 0
- length(recipients.bcc) is 0
any of:
- sender.email.email is recipients.to[0].email.email
- recipients.to[0].email.domain.valid is False
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
any of
headers.hopswhere:any of
.fieldswhere:- .value contains 'compauth=pass'
not:
- coalesce(headers.auth_summary.dmarc.pass)
not:
- coalesce(headers.auth_summary.spf.pass)
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].value, recipients.bcc, recipients.cc, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
strings.icontains | substring | compauth=pass |