Detection rules › Sublime MQL

Spam: New job cold outreach from unsolicited sender

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects unsolicited messages congratulating recipients on new jobs or roles that contain unsubscribe links, calendar booking links, or exhibit B2B cold outreach characteristics from senders who have not been previously contacted.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam

Event coverage

Rule body MQL

type.inbound
// direct outreach to sender
and length(recipients.to) == 1
// talking about new job
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'congrat(?:ulation)?s on the new (?:job|gig|role)')
)
// body link to unsubscribe or to book time, otherwise use NLU on the body current thread
and (
  any(body.links,
      strings.icontains(.href_url.url, "unsubscribe")
      or strings.icontains(.href_url.url, "opt-out")
      or strings.icontains(.href_url.url, "preferences")
      or strings.icontains(.href_url.url, "calendar")
  )
  or any(ml.nlu_classifier(body.current_thread.text).topics,
         .name == "B2B Cold Outreach" and .confidence != "low"
  )
)
// not someone they have reached out to before
and not profile.by_sender().solicited

Detection logic

Scope: inbound message.

Detects unsolicited messages congratulating recipients on new jobs or roles that contain unsubscribe links, calendar booking links, or exhibit B2B cold outreach characteristics from senders who have not been previously contacted.

  1. inbound message
  2. length(recipients.to) is 1
  3. any of [body.current_thread.text, subject.subject] where:
    • . matches 'congrat(?:ulation)?s on the new (?:job|gig|role)'
  4. any of:
    • any of body.links where any holds:
      • .href_url.url contains 'unsubscribe'
      • .href_url.url contains 'opt-out'
      • .href_url.url contains 'preferences'
      • .href_url.url contains 'calendar'
    • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
      • .name is 'B2B Cold Outreach'
      • .confidence is not 'low'
  5. not:
    • profile.by_sender().solicited

Inspects: body.current_thread.text, body.links, body.links[].href_url.url, recipients.to, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, regex.icontains, strings.icontains.

Indicators matched (6)

FieldMatchValue
regex.icontainsregexcongrat(?:ulation)?s on the new (?:job|gig|role)
strings.icontainssubstringunsubscribe
strings.icontainssubstringopt-out
strings.icontainssubstringpreferences
strings.icontainssubstringcalendar
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsB2B Cold Outreach