Detection rules › Sublime MQL
Service abuse: Free provider with SendGrid routing
Message From header includes a free email provider domain but is routed through SendGrid infrastructure, indicating potential service abuse for delivery evasion.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free email provider, Evasion |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.domain in $free_email_providers
and any(headers.domains, .root_domain == "sendgrid.net")
and not any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "benign"
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Bounce Back and Delivery Failure Notifications"
)
Detection logic
Scope: inbound message.
Message From header includes a free email provider domain but is routed through SendGrid infrastructure, indicating potential service abuse for delivery evasion.
- inbound message
- sender.email.domain.domain in $free_email_providers
any of
headers.domainswhere:- .root_domain is 'sendgrid.net'
not:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name is 'benign'
not:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name is 'Bounce Back and Delivery Failure Notifications'
Inspects: body.current_thread.text, headers.domains, headers.domains[].root_domain, sender.email.domain.domain, type.inbound. Sensors: ml.nlu_classifier. Reference lists: $free_email_providers.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
headers.domains[].root_domain | equals | sendgrid.net |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | benign |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Bounce Back and Delivery Failure Notifications |