Detection rules › Sublime MQL
Spam: Campaign with excessive display-text and keywords found
Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) > 0
and any(body.links, length(.display_text) > 3000)
and any(body.links,
regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b')
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.
- inbound message
- length(body.links) > 0
any of
body.linkswhere:- length(.display_text) > 3000
any of
body.linkswhere:.display_text matches any of 2 patterns
(\bPassword:)Hi.{0,5}Welcome\b
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].display_text, type.inbound. Sensors: profile.by_sender, regex.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | (\bPassword:) |
regex.icontains | regex | Hi.{0,5}Welcome\b |