Detection rules › Sublime MQL
Service abuse: Facebook business with action required subject
Detects messages from the Facebook business domain containing 'action required' in the subject line, commonly used to create urgency in impersonation attacks.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
sender.email.domain.root_domain == "facebook.com"
or sender.email.domain.root_domain == "facebookmail.com"
)
and 3 of (
strings.icontains(subject.subject, "Action required"),
strings.icontains(subject.subject, "invited to join"),
strings.icontains(subject.subject, "partner request"),
strings.icontains(body.current_thread.text, "You've been invited"),
strings.icontains(body.current_thread.text, "You're invited"),
strings.icontains(body.current_thread.text,
"You've received a partner request"
),
strings.icontains(body.current_thread.text,
"not part of or affiliated with Meta"
),
strings.icontains(body.current_thread.text, "Agency Partner")
)
and (
// and the link is recently registered
any(body.links, network.whois(.href_url.domain).days_old <= 30)
or any(body.links,
// if the link is still active, check if it's cred theft
any(ml.nlu_classifier(beta.ocr(ml.link_analysis(.).screenshot).text).intents,
.name == "cred_theft" and .confidence != "low"
)
)
// or look for the legit Meta footer address
or strings.icontains(body.current_thread.text,
'1 Meta Way, Menlo Park, CA 94025'
)
)
Detection logic
Scope: inbound message.
Detects messages from the Facebook business domain containing 'action required' in the subject line, commonly used to create urgency in impersonation attacks.
- inbound message
any of:
- sender.email.domain.root_domain is 'facebook.com'
- sender.email.domain.root_domain is 'facebookmail.com'
at least 3 of:
- subject.subject contains 'Action required'
- subject.subject contains 'invited to join'
- subject.subject contains 'partner request'
- body.current_thread.text contains "You've been invited"
- body.current_thread.text contains "You're invited"
- body.current_thread.text contains "You've received a partner request"
- body.current_thread.text contains 'not part of or affiliated with Meta'
- body.current_thread.text contains 'Agency Partner'
any of:
any of
body.linkswhere:- network.whois(.href_url.domain).days_old ≤ 30
any of
body.linkswhere:any of
ml.nlu_classifier(beta.ocr(ml.link_analysis(.).screenshot).text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
- body.current_thread.text contains '1 Meta Way, Menlo Park, CA 94025'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.ocr, ml.link_analysis, ml.nlu_classifier, network.whois, strings.icontains.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | facebook.com |
sender.email.domain.root_domain | equals | facebookmail.com |
strings.icontains | substring | Action required |
strings.icontains | substring | invited to join |
strings.icontains | substring | partner request |
strings.icontains | substring | You've been invited |
strings.icontains | substring | You're invited |
strings.icontains | substring | You've received a partner request |
strings.icontains | substring | not part of or affiliated with Meta |
strings.icontains | substring | Agency Partner |
ml.nlu_classifier(beta.ocr(ml.link_analysis(body.links[]).screenshot).text).intents[].name | equals | cred_theft |
strings.icontains | substring | 1 Meta Way, Menlo Park, CA 94025 |