Detection rules › Sublime MQL
Self-sender with copy/paste instructions and suspicious domains (French/Français)
Detects messages where the sender emails themselves with French text containing 'copier' (copy) and 'coller' (paste) instructions, along with suspicious domains like pages.dev or web.app. The subject line contains both the sender's email and display name, which are different values.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Free subdomain host, Social engineering |
Event coverage
Rule body MQL
type.inbound
// self sender
and (
length(recipients.to) == 1
and length(recipients.cc) == 0
and sender.email.email in map(recipients.to, .email.email)
)
and strings.icontains(subject.subject, sender.email.email)
and strings.icontains(subject.subject, sender.display_name)
and sender.email.email != sender.display_name
// copy
and strings.icontains(body.current_thread.text, 'copier')
// paste
and strings.icontains(body.current_thread.text, 'coller')
and (
strings.contains(body.current_thread.text, '.pages.dev')
or strings.contains(body.current_thread.text, '.web.app')
)
Detection logic
Scope: inbound message.
Detects messages where the sender emails themselves with French text containing 'copier' (copy) and 'coller' (paste) instructions, along with suspicious domains like pages.dev or web.app. The subject line contains both the sender's email and display name, which are different values.
- inbound message
all of:
- length(recipients.to) is 1
- length(recipients.cc) is 0
- sender.email.email in map(recipients.to, .email.email)
- strings.icontains(subject.subject)
- strings.icontains(subject.subject)
- sender.email.email is not sender.display_name
- body.current_thread.text contains 'copier'
- body.current_thread.text contains 'coller'
any of:
- body.current_thread.text contains '.pages.dev'
- body.current_thread.text contains '.web.app'
Inspects: body.current_thread.text, recipients.cc, recipients.to, recipients.to[].email.email, sender.display_name, sender.email.email, subject.subject, type.inbound. Sensors: strings.contains, strings.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | copier |
strings.icontains | substring | coller |
strings.contains | substring | .pages.dev |
strings.contains | substring | .web.app |