Detection rules › Sublime MQL

Self-sender with copy/paste instructions and suspicious domains (French/Français)

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages where the sender emails themselves with French text containing 'copier' (copy) and 'coller' (paste) instructions, along with suspicious domains like pages.dev or web.app. The subject line contains both the sender's email and display name, which are different values.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Free subdomain host, Social engineering

Event coverage

Rule body MQL

type.inbound
// self sender
and (
  length(recipients.to) == 1
  and length(recipients.cc) == 0
  and sender.email.email in map(recipients.to, .email.email)
)
and strings.icontains(subject.subject, sender.email.email)
and strings.icontains(subject.subject, sender.display_name)
and sender.email.email != sender.display_name
// copy
and strings.icontains(body.current_thread.text, 'copier')
// paste
and strings.icontains(body.current_thread.text, 'coller')
and (
  strings.contains(body.current_thread.text, '.pages.dev')
  or strings.contains(body.current_thread.text, '.web.app')
)

Detection logic

Scope: inbound message.

Detects messages where the sender emails themselves with French text containing 'copier' (copy) and 'coller' (paste) instructions, along with suspicious domains like pages.dev or web.app. The subject line contains both the sender's email and display name, which are different values.

  1. inbound message
  2. all of:
    • length(recipients.to) is 1
    • length(recipients.cc) is 0
    • sender.email.email in map(recipients.to, .email.email)
  3. strings.icontains(subject.subject)
  4. strings.icontains(subject.subject)
  5. sender.email.email is not sender.display_name
  6. body.current_thread.text contains 'copier'
  7. body.current_thread.text contains 'coller'
  8. any of:
    • body.current_thread.text contains '.pages.dev'
    • body.current_thread.text contains '.web.app'

Inspects: body.current_thread.text, recipients.cc, recipients.to, recipients.to[].email.email, sender.display_name, sender.email.email, subject.subject, type.inbound. Sensors: strings.contains, strings.icontains.

Indicators matched (4)

FieldMatchValue
strings.icontainssubstringcopier
strings.icontainssubstringcoller
strings.containssubstring.pages.dev
strings.containssubstring.web.app