Detection rules › Sublime MQL
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)
The default Microsoft Exchange Online sender domain, onmicrosoft.com, is commonly used to send unwanted and malicious email. Enable this rule in your environment if receiving email from the onmicrosoft.com domain is unexpected behaviour.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, Credential Phishing, Spam |
| Tactics and techniques | Free email provider, Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
sender.email.domain.root_domain == "onmicrosoft.com"
or (
strings.icontains(sender.display_name, "onmicrosoft.com")
and sender.email.domain.valid == false
)
)
and length(recipients.to) < 2
and length(body.links) > 0
// bounce-back negations
and not strings.like(sender.email.local_part,
"*postmaster*",
"*mailer-daemon*",
"*administrator*"
)
and not any(attachments,
.content_type in (
"message/rfc822",
"message/delivery-status",
"text/calendar"
)
or (.content_type == "text/plain" and .file_extension == "ics")
)
// negating legit replies
and not (
(
strings.istarts_with(subject.subject, "RE:")
or strings.istarts_with(subject.subject, "FW:")
or strings.istarts_with(subject.subject, "FWD:")
or regex.imatch(subject.subject,
'(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
)
or strings.istarts_with(subject.subject, "Réponse automatique")
)
and (length(headers.references) > 0 and headers.in_reply_to is not null)
)
// negating auto-replies
and not (
any(headers.hops,
any(.fields, .name =~ "auto-submitted" and .value =~ "auto-generated")
and any(.fields,
.name =~ "X-MS-Exchange-Generated-Message-Source"
and .value not in ("Antispam Quarantine Agent")
)
)
)
// Microsoft has some legit onmicrosoft domains...
and not (
sender.email.domain.domain == "microsoft.onmicrosoft.com"
and headers.auth_summary.spf.pass
and all(body.links, .href_url.domain.root_domain == "microsoft.com")
)
// construct the proper sender domain and check against known recipients
and not strings.concat(sender.email.domain.subdomain,
".",
sender.email.domain.tld
) in $recipient_domains
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not sender.email.domain.domain in $org_domains
Detection logic
Scope: inbound message.
The default Microsoft Exchange Online sender domain, onmicrosoft.com, is commonly used to send unwanted and malicious email. Enable this rule in your environment if receiving email from the onmicrosoft.com domain is unexpected behaviour.
- inbound message
any of:
- sender.email.domain.root_domain is 'onmicrosoft.com'
all of:
- sender.display_name contains 'onmicrosoft.com'
- sender.email.domain.valid is False
- length(recipients.to) < 2
- length(body.links) > 0
not:
sender.email.local_part matches any of 3 patterns
*postmaster**mailer-daemon**administrator*
not:
any of
attachmentswhere any holds:- .content_type in ('message/rfc822', 'message/delivery-status', 'text/calendar')
all of:
- .content_type is 'text/plain'
- .file_extension is 'ics'
not:
all of:
any of:
- subject.subject starts with 'RE:'
- subject.subject starts with 'FW:'
- subject.subject starts with 'FWD:'
- subject.subject matches '(\\[[^\\]]+\\]\\s?){0,3}(re|fwd?|automat.*)\\s?:.*'
- subject.subject starts with 'Réponse automatique'
all of:
- length(headers.references) > 0
- headers.in_reply_to is set
not:
any of
headers.hopswhere all hold:any of
.fieldswhere all hold:- .name is 'auto-submitted'
- .value is 'auto-generated'
any of
.fieldswhere all hold:- .name is 'X-MS-Exchange-Generated-Message-Source'
- .value not in ('Antispam Quarantine Agent')
not:
all of:
- sender.email.domain.domain is 'microsoft.onmicrosoft.com'
- headers.auth_summary.spf.pass
all of
body.linkswhere:- .href_url.domain.root_domain is 'microsoft.com'
not:
- strings.concat(sender.email.domain.subdomain, '.') in $recipient_domains
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- sender.email.domain.domain in $org_domains
Inspects: attachments[].content_type, attachments[].file_extension, body.links, body.links[].href_url.domain.root_domain, headers.auth_summary.spf.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.in_reply_to, headers.references, recipients.to, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.domain.subdomain, sender.email.domain.tld, sender.email.domain.valid, sender.email.local_part, subject.subject, type.inbound. Sensors: profile.by_sender, regex.imatch, strings.concat, strings.icontains, strings.istarts_with, strings.like. Reference lists: $org_domains, $recipient_domains.
Indicators matched (21)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | onmicrosoft.com |
strings.icontains | substring | onmicrosoft.com |
strings.like | substring | *postmaster* |
strings.like | substring | *mailer-daemon* |
strings.like | substring | *administrator* |
attachments[].content_type | member | message/rfc822 |
attachments[].content_type | member | message/delivery-status |
attachments[].content_type | member | text/calendar |
attachments[].content_type | equals | text/plain |
attachments[].file_extension | equals | ics |
strings.istarts_with | prefix | RE: |
strings.istarts_with | prefix | FW: |
9 more
strings.istarts_with | prefix | FWD: |
regex.imatch | regex | (\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.* |
strings.istarts_with | prefix | Réponse automatique |
headers.hops[].fields[].name | equals | auto-submitted |
headers.hops[].fields[].value | equals | auto-generated |
headers.hops[].fields[].name | equals | X-MS-Exchange-Generated-Message-Source |
headers.hops[].fields[].value | member | Antispam Quarantine Agent |
sender.email.domain.domain | equals | microsoft.onmicrosoft.com |
body.links[].href_url.domain.root_domain | equals | microsoft.com |