Detection rules › Sublime MQL
Spam: Fake dating profile notification
Detects dating-themed messages from free email providers containing links with the recipient's email address embedded in URL parameters, combined with suspicious language or topics in the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.root_domain in $free_email_providers
// not a reply
and length(headers.references) == 0
and 0 < length(distinct(body.current_thread.links, .href_url.domain.root_domain)
) <= 3
and any(body.links,
(
any(values(.href_url.query_params_decoded),
any(.,
strings.parse_email(.).email in map(recipients.to,
.email.email
)
)
)
)
or regex.icontains(.display_text,
'(?:(open|view|read|private).{0,15}message)'
)
or any([.href_url.path, .display_text],
any((ml.nlu_classifier(.).topics),
.name in ("Romance", "Sexually Explicit Messages")
)
)
// visit the URL and check the effecitve url
or any(values(ml.link_analysis(.).effective_url.query_params_decoded),
any(.,
strings.parse_email(.).email in map(recipients.to,
.email.email
)
)
)
)
and (
any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "org"
and strings.ilike(.text,
"*Flirt*",
"*Singles*",
"*Date*",
"*Dating*",
"*Girls*",
"*Love*",
"*Hook*up*"
)
)
or any(ml.nlu_classifier(body.current_thread.text).topics, .name == "Romance")
)
Detection logic
Scope: inbound message.
Detects dating-themed messages from free email providers containing links with the recipient's email address embedded in URL parameters, combined with suspicious language or topics in the message body.
- inbound message
- sender.email.domain.root_domain in $free_email_providers
- length(headers.references) is 0
all of:
- length(distinct(body.current_thread.links, .href_url.domain.root_domain)) > 0
- length(distinct(body.current_thread.links, .href_url.domain.root_domain)) ≤ 3
any of
body.linkswhere any holds:any of
values(.href_url.query_params_decoded)where:any of
.where:- strings.parse_email(.).email in map(recipients.to, .email.email)
- .display_text matches '(?:(open|view|read|private).{0,15}message)'
any of
[.href_url.path, .display_text]where:any of
ml.nlu_classifier(.).topicswhere:- .name in ('Romance', 'Sexually Explicit Messages')
any of
values(...)where:any of
.where:- strings.parse_email(.).email in map(recipients.to, .email.email)
any of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere all hold:- .name is 'org'
.text matches any of 7 patterns
*Flirt**Singles**Date**Dating**Girls**Love**Hook*up*
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name is 'Romance'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.path, body.links[].href_url.query_params_decoded, headers.references, recipients.to, recipients.to[].email.email, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, regex.icontains, strings.ilike, strings.parse_email. Reference lists: $free_email_providers.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | (?:(open|view|read|private).{0,15}message) |
ml.nlu_classifier([body.links[].href_url.path, body.links[].display_text][]).topics[].name | member | Romance |
ml.nlu_classifier([body.links[].href_url.path, body.links[].display_text][]).topics[].name | member | Sexually Explicit Messages |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | org |
strings.ilike | substring | *Flirt* |
strings.ilike | substring | *Singles* |
strings.ilike | substring | *Date* |
strings.ilike | substring | *Dating* |
strings.ilike | substring | *Girls* |
strings.ilike | substring | *Love* |
strings.ilike | substring | *Hook*up* |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Romance |