Detection rules › Sublime MQL
Spam: Unsolicited WordPress account creation or password reset request
Detects messages containing WordPress password reset links where the login parameter does not match the recipient's email address. The rule triggers for unsolicited senders, previously malicious senders, or when DMARC authentication fails.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and body.html.raw is null
and any(body.links,
.href_url.path == "/wp-login.php"
and any(.href_url.query_params_decoded["key"], . is not null)
and any(.href_url.query_params_decoded["login"],
any(recipients.to,
.email.local_part != .. and .email.email != ..
)
)
)
and (
(
not profile.by_sender().solicited
and profile.by_sender().prevalence == "new"
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
or not headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages containing WordPress password reset links where the login parameter does not match the recipient's email address. The rule triggers for unsolicited senders, previously malicious senders, or when DMARC authentication fails.
- inbound message
- body.html.raw is missing
any of
body.linkswhere all hold:- .href_url.path is '/wp-login.php'
any of
.href_url.query_params_decoded['key']where:- . is set
any of
.href_url.query_params_decoded['login']where:any of
recipients.towhere all hold:- .email.local_part is not .
- .email.email is not .
any of:
all of:
not:
- profile.by_sender().solicited
- profile.by_sender().prevalence is 'new'
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- headers.auth_summary.dmarc.pass
Inspects: body.html.raw, body.links, body.links[].href_url.path, body.links[].href_url.query_params_decoded['key'], body.links[].href_url.query_params_decoded['login'], headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.email, recipients.to[].email.local_part, type.inbound. Sensors: profile.by_sender.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.path | equals | /wp-login.php |