Detection rules › Sublime MQL
Spam: Mastercard promotional content with image-based body
Detects messages promoting untrustworthy Mastercard credit cards that contain both financial communications and promotional content topics, with the message body primarily consisting of image content rather than text. Excludes legitimate payment-related Mastercard communications and applies additional scrutiny to high-trust sender domains that fail DMARC authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Image as content, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| headers.auth_summary |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and length(attachments) == 0
and not subject.is_forward
and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
.name == "Financial Communications"
)
and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
.name == "Advertising and Promotions"
)
// mastercard mention
and strings.icontains(beta.ocr(file.message_screenshot()).text, "mastercard")
and not strings.icontains(beta.ocr(file.message_screenshot()).text,
"paying with mastercard"
)
// body is image
and (
length(beta.ocr(file.message_screenshot()).text) / length(body.current_thread.text
)
) > 10
and length(body.previous_threads) == 0
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects messages promoting untrustworthy Mastercard credit cards that contain both financial communications and promotional content topics, with the message body primarily consisting of image content rather than text. Excludes legitimate payment-related Mastercard communications and applies additional scrutiny to high-trust sender domains that fail DMARC authentication.
- inbound message
- length(attachments) is 0
not:
- subject.is_forward
any of
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topicswhere:- .name is 'Financial Communications'
any of
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topicswhere:- .name is 'Advertising and Promotions'
- beta.ocr(file.message_screenshot()).text contains 'mastercard'
not:
- beta.ocr(file.message_screenshot()).text contains 'paying with mastercard'
- length(beta.ocr(file.message_screenshot()).text) / length(body.current_thread.text) > 10
- length(body.previous_threads) is 0
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.previous_threads, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.is_forward, type.inbound. Sensors: beta.ocr, file.message_screenshot, ml.nlu_classifier, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].name | equals | Financial Communications |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].name | equals | Advertising and Promotions |
strings.icontains | substring | mastercard |
strings.icontains | substring | paying with mastercard |