Detection rules › Sublime MQL
Spam: New job cold outreach from unsolicited sender
Detects unsolicited messages congratulating recipients on new jobs or roles that contain unsubscribe links, calendar booking links, or exhibit B2B cold outreach characteristics from senders who have not been previously contacted.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| recipients |
| subject |
| type |
Rule body MQL
type.inbound
// direct outreach to sender
and length(recipients.to) == 1
// talking about new job
and any([body.current_thread.text, subject.subject],
regex.icontains(., 'congrat(?:ulation)?s on the new (?:job|gig|role)')
)
// body link to unsubscribe or to book time, otherwise use NLU on the body current thread
and (
any(body.links,
strings.icontains(.href_url.url, "unsubscribe")
or strings.icontains(.href_url.url, "opt-out")
or strings.icontains(.href_url.url, "preferences")
or strings.icontains(.href_url.url, "calendar")
)
or any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "B2B Cold Outreach" and .confidence != "low"
)
)
// not someone they have reached out to before
and not profile.by_sender().solicited
Detection logic
Scope: inbound message.
Detects unsolicited messages congratulating recipients on new jobs or roles that contain unsubscribe links, calendar booking links, or exhibit B2B cold outreach characteristics from senders who have not been previously contacted.
- inbound message
- length(recipients.to) is 1
any of
[body.current_thread.text, subject.subject]where:- . matches 'congrat(?:ulation)?s on the new (?:job|gig|role)'
any of:
any of
body.linkswhere any holds:- .href_url.url contains 'unsubscribe'
- .href_url.url contains 'opt-out'
- .href_url.url contains 'preferences'
- .href_url.url contains 'calendar'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'B2B Cold Outreach'
- .confidence is not 'low'
not:
- profile.by_sender().solicited
Inspects: body.current_thread.text, body.links, body.links[].href_url.url, recipients.to, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, regex.icontains, strings.icontains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | congrat(?:ulation)?s on the new (?:job|gig|role) |
strings.icontains | substring | unsubscribe |
strings.icontains | substring | opt-out |
strings.icontains | substring | preferences |
strings.icontains | substring | calendar |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | B2B Cold Outreach |