Detection rules › Sublime MQL

Sublime MQL rules: sendgrid

Rule	Severity
Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail	`high`

Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects inbound messages from hungerrush.com domain that contain SendGrid tracking pixels and reference redacted ProtonMail addresses, indicating potential abuse of legitimate services for suspicious targeting.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud
Tactics and techniques	Evasion

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.html
sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain == "hungerrush.com"
// html contains sendgrid open tracking pixel
and strings.icontains(body.html.raw, 'sendgrid.net/wf/open')
// body contains "redacted" proton email address
and regex.icontains(body.current_thread.text, '(?:\*\*|protonmail\.com)')

Detection logic

Scope: inbound message.

inbound message
sender.email.domain.root_domain is 'hungerrush.com'
body.html.raw contains 'sendgrid.net/wf/open'
body.current_thread.text matches '(?:\\*\\*|protonmail\\.com)'

Inspects: body.current_thread.text, body.html.raw, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains.

Indicators matched (3)

Field	Match	Value
`sender.email.domain.root_domain`	equals	`hungerrush.com`
`strings.icontains`	substring	`sendgrid.net/wf/open`
`regex.icontains`	regex	`(?:\\\|protonmail\.com)`

Stages and Predicates

Stage 1: `mql_rule`

and
  body.current_thread.text regex_match "(?:\\*\\*|protonmail\\.com)"
  body.html.raw contains "sendgrid.net/wf/open"
  sender.email.domain.root_domain eq "hungerrush.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`(?:**\|protonmail.com)`	`field:"body.current_thread.text" kind:regex_match value:"(?:**\|protonmail.com)"`
`body.html.raw`	contains	`sendgrid.net/wf/open`	`field:"body.html.raw" kind:contains value:"sendgrid.net/wf/open"`
`sender.email.domain.root_domain`	eq	`hungerrush.com`	`field:"sender.email.domain.root_domain" kind:eq value:"hungerrush.com"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`