Detection rules › Sublime MQL
Unusually long local part from untrusted sender address
Detects messages with unusually long local address parts (before the @) from senders outside trusted domains and without verified authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender.email |
Rule body MQL
// max length of the local_part for exchange is 315
// https://learn.microsoft.com/en-us/exchange/mail-flow/mail-routing/recipient-resolution?view=exchserver-2019&viewFallbackFrom=exchonline-ww
100 < length(sender.email.local_part)
// not org_domains
and not (
sender.email.domain.root_domain in $org_domains
and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and headers.auth_summary.dmarc.pass
)
// remove common senders, unless marked malicious
and not (
profile.by_sender_email().prevalence == "common"
and profile.by_sender_email().any_messages_malicious_or_spam == false
)
// a common observed benign cases of this due to Internet Mail Connector Encapsulated Address (IMCEA)
and not strings.istarts_with(sender.email.local_part, 'imcea')
// no previous false positives on this specific sender
and not profile.by_sender_email().any_messages_benign
Detection logic
Detects messages with unusually long local address parts (before the @) from senders outside trusted domains and without verified authentication.
- length(sender.email.local_part) > 100
not:
all of:
- sender.email.domain.root_domain in $org_domains
- headers.auth_summary.dmarc.pass
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- headers.auth_summary.dmarc.pass
not:
all of:
- profile.by_sender_email().prevalence is 'common'
- profile.by_sender_email().any_messages_malicious_or_spam is False
not:
- sender.email.local_part starts with 'imcea'
not:
- profile.by_sender_email().any_messages_benign
Inspects: headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, sender.email.local_part. Sensors: profile.by_sender_email, strings.istarts_with. Reference lists: $high_trust_sender_root_domains, $org_domains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.istarts_with | prefix | imcea |