Detection rules › Sublime MQL

Spam: Sendersrv.com with financial communications and unsubscribe language

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from sendersrv.com infrastructure containing unsubscribe language and financial communication topics, indicating potential abuse of the bulk email service for unauthorized financial solicitations.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(headers.domains, .root_domain == "sendersrv.com")
and strings.icontains(body.current_thread.text, 'unsubscribe')
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Financial Communications" and .confidence != "low"
)

Detection logic

Scope: inbound message.

Detects messages from sendersrv.com infrastructure containing unsubscribe language and financial communication topics, indicating potential abuse of the bulk email service for unauthorized financial solicitations.

  1. inbound message
  2. any of headers.domains where:
    • .root_domain is 'sendersrv.com'
  3. body.current_thread.text contains 'unsubscribe'
  4. any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
    • .name is 'Financial Communications'
    • .confidence is not 'low'

Inspects: body.current_thread.text, headers.domains, headers.domains[].root_domain, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.

Indicators matched (3)

FieldMatchValue
headers.domains[].root_domainequalssendersrv.com
strings.icontainssubstringunsubscribe
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsFinancial Communications