Detection rules › Sublime MQL

Sublime MQL rules: subject

Rule	Severity
Subject: Suspicious bracketed reference	`high`

Subject: Suspicious bracketed reference

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages with subject lines containing bracketed patterns that follow a specific format with repeated characters, numeric sequences, and structured tracking identifiers commonly used in malicious automated messaging systems.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Evasion, Impersonation: Brand

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

subject
type

Rule Body

type.inbound
and strings.contains(subject.base, '[')
and strings.ends_with(subject.base, ']')
and any(regex.extract(subject.base,
                      '\[(?P<first>.)(?P<second>.)\-(?P<second_part>[^\-]+)\-(?P<third_section>[^\]]+)\]$'
        ),
        .named_groups["first"] == .named_groups["second"]
        and regex.match(.named_groups["second_part"], '^\d+$')
        and regex.contains(.named_groups["third_section"], '\d+$')
        and strings.istarts_with(.named_groups["third_section"],
                                 .named_groups["first"]
        )
)

Detection Logic

Scope: inbound message.

inbound message
subject.base contains '['
subject.base ends with ']'
any(regex.extract(subject.base, '\[(?P<first>.)(?P<second>.)\-(?P<second_part>[^\-]+)\-(?P<third_section>[^\]]+)\]$' ), .named_groups["first"] == .named_groups["second"] and regex.match(.named_groups["second_part"], '^\d+$') and regex.contains(.named_groups["third_section"], '\d+$') and strings.istarts_with(.named_groups["third_section"], .named_groups["first"] ) )

Inspects: subject.base, type.inbound. Sensors: regex.contains, regex.extract, regex.match, strings.contains, strings.ends_with, strings.istarts_with.

Indicators Matched (5)

Field	Match	Value
`strings.contains`	substring	`[`
`strings.ends_with`	suffix	`]`
`regex.extract`	regex	`\[(?P<first>.)(?P<second>.)\-(?P<second_part>[^\-]+)\-(?P<third_section>[^\]]+)\]$`
`regex.match`	regex	`^\d+$`
`regex.contains`	regex	`\d+$`

Stages and Predicates

Stage 1: `mql_rule`

and
  subject.base contains "["
  subject.base ends_with "]"
  type.inbound eq "true"
   macro "any(regex.extract(subject.base,\n                      '\\[(?P<first>.)(?P<second>.)\\-(?P<second_part>[^\\-]+)\\-(?P<third_section>[^\\]]+)\\]$'\n        ),\n        .named_groups[\"first\"] == .named_groups[\"second\"]\n        and regex.match(.named_groups[\"second_part\"], '^\\d+$')\n        and regex.contains(.named_groups[\"third_section\"], '\\d+$')\n        and strings.istarts_with(.named_groups[\"third_section\"],\n                                 .named_groups[\"first\"]\n        )\n)"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`subject.base`	contains	`[`	`field:"subject.base" kind:contains value:"["`
`subject.base`	ends_with	`]`	`field:"subject.base" kind:ends_with value:"]"`
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Back to all Sublime MQL rules