Detection rules › Sublime MQL
Sender: IP address in local part
Detects messages where the sender's email local part contains an IPv4 address, which is commonly used in malicious campaigns to bypass filters or appear legitimate.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam, Credential Phishing, BEC/Fraud |
| Tactics and techniques | Evasion, Spoofing |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.current_thread.text) > 100
and regex.icontains(sender.email.local_part,
'(?:\d{1,3}\.){3}\d{1,3}[^\.][[:alpha:]]+',
'[[:alpha:]]+(?:\d{1,3}\.){3}\d{1,3}[^\.]'
)
and not (
strings.ilike(sender.email.local_part, "*report*", "*abuse*")
or any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Bounce Back and Delivery Failure Notifications"
and .confidence != "low"
)
)
Detection logic
Scope: inbound message.
Detects messages where the sender's email local part contains an IPv4 address, which is commonly used in malicious campaigns to bypass filters or appear legitimate.
- inbound message
- length(body.current_thread.text) > 100
sender.email.local_part matches any of 2 patterns
(?:\d{1,3}\.){3}\d{1,3}[^\.][[:alpha:]]+[[:alpha:]]+(?:\d{1,3}\.){3}\d{1,3}[^\.]
none of:
sender.email.local_part matches any of 2 patterns
*report**abuse*
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Bounce Back and Delivery Failure Notifications'
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.local_part, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.ilike.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | (?:\d{1,3}\.){3}\d{1,3}[^\.][[:alpha:]]+ |
regex.icontains | regex | [[:alpha:]]+(?:\d{1,3}\.){3}\d{1,3}[^\.] |
strings.ilike | substring | *report* |
strings.ilike | substring | *abuse* |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Bounce Back and Delivery Failure Notifications |