Detection rules › Sublime MQL
Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail
Detects inbound messages from hungerrush.com domain that contain SendGrid tracking pixels and reference redacted ProtonMail addresses, indicating potential abuse of legitimate services for suspicious targeting.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| body.html |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain == "hungerrush.com"
// html contains sendgrid open tracking pixel
and strings.icontains(body.html.raw, 'sendgrid.net/wf/open')
// body contains "redacted" proton email address
and regex.icontains(body.current_thread.text, '(?:\*\*|protonmail\.com)')
Detection logic
Scope: inbound message.
Detects inbound messages from hungerrush.com domain that contain SendGrid tracking pixels and reference redacted ProtonMail addresses, indicating potential abuse of legitimate services for suspicious targeting.
- inbound message
- sender.email.domain.root_domain is 'hungerrush.com'
- body.html.raw contains 'sendgrid.net/wf/open'
- body.current_thread.text matches '(?:\\*\\*|protonmail\\.com)'
Inspects: body.current_thread.text, body.html.raw, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | hungerrush.com |
strings.icontains | substring | sendgrid.net/wf/open |
regex.icontains | regex | (?:\*\*|protonmail\.com) |