Detection rules › Sublime MQL
Service abuse: Roomsy with unrelated body content
Detects messages from Roomsy.com with a structured noreply sender pattern that contain content unrelated to travel, transportation, or order confirmations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain == "roomsy.com"
and regex.imatch(sender.email.local_part, "noreply[0-9]{5}")
and not any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Travel and Transportation", "Order Confirmations")
)
Detection logic
Scope: inbound message.
Detects messages from Roomsy.com with a structured noreply sender pattern that contain content unrelated to travel, transportation, or order confirmations.
- inbound message
- sender.email.domain.root_domain is 'roomsy.com'
- sender.email.local_part matches 'noreply[0-9]{5}'
not:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Travel and Transportation', 'Order Confirmations')
Inspects: body.current_thread.text, sender.email.domain.root_domain, sender.email.local_part, type.inbound. Sensors: ml.nlu_classifier, regex.imatch.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | roomsy.com |
regex.imatch | regex | noreply[0-9]{5} |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Travel and Transportation |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Order Confirmations |