Detection rules › Sublime MQL
Spam: Sendersrv.com with financial communications and unsubscribe language
Detects messages from sendersrv.com infrastructure containing unsubscribe language and financial communication topics, indicating potential abuse of the bulk email service for unauthorized financial solicitations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(headers.domains, .root_domain == "sendersrv.com")
and strings.icontains(body.current_thread.text, 'unsubscribe')
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Financial Communications" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects messages from sendersrv.com infrastructure containing unsubscribe language and financial communication topics, indicating potential abuse of the bulk email service for unauthorized financial solicitations.
- inbound message
any of
headers.domainswhere:- .root_domain is 'sendersrv.com'
- body.current_thread.text contains 'unsubscribe'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Financial Communications'
- .confidence is not 'low'
Inspects: body.current_thread.text, headers.domains, headers.domains[].root_domain, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
headers.domains[].root_domain | equals | sendersrv.com |
strings.icontains | substring | unsubscribe |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Financial Communications |