Detection rules › Sublime MQL

Sublime MQL rules: subject

Rule	Severity
Subject: Suspicious bracketed reference	`high`

Subject: Suspicious bracketed reference

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages with subject lines containing bracketed patterns that follow a specific format with repeated characters, numeric sequences, and structured tracking identifiers commonly used in malicious automated messaging systems.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Evasion, Impersonation: Brand

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

subject
type

Rule body

type.inbound
and strings.contains(subject.base, '[')
and strings.ends_with(subject.base, ']')
and any(regex.extract(subject.base,
                      '\[(?P<first>.)(?P<second>.)\-(?P<second_part>[^\-]+)\-(?P<third_section>[^\]]+)\]$'
        ),
        .named_groups["first"] == .named_groups["second"]
        and regex.match(.named_groups["second_part"], '^\d+$')
        and regex.contains(.named_groups["third_section"], '\d+$')
        and strings.istarts_with(.named_groups["third_section"],
                                 .named_groups["first"]
        )
)

Detection logic

Scope: inbound message.

inbound message
subject.base contains '['
subject.base ends with ']'
any of regex.extract(subject.base) where all hold:
- .named_groups['first'] is .named_groups['second']
- .named_groups['second_part'] matches '^\\d+$'
- .named_groups['third_section'] matches '\\d+$'
- strings.istarts_with(.named_groups['third_section'])

Inspects: subject.base, type.inbound. Sensors: regex.contains, regex.extract, regex.match, strings.contains, strings.ends_with, strings.istarts_with.

Indicators matched (5)

Field	Match	Value
`strings.contains`	substring	`[`
`strings.ends_with`	suffix	`]`
`regex.extract`	regex	`\[(?P<first>.)(?P<second>.)\-(?P<second_part>[^\-]+)\-(?P<third_section>[^\]]+)\]$`
`regex.match`	regex	`^\d+$`
`regex.contains`	regex	`\d+$`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(regex.extract(subject.base))
    and
      regex.extract(subject.base).named_groups['first'] cross_field_compare "regex.extract(subject.base).named_groups['second']"
      regex.extract(subject.base).named_groups['second_part'] regex_match "^\\d+$"
      regex.extract(subject.base).named_groups['third_section'] regex_match "\\d+$"
      strings.istarts_with func_call "strings.istarts_with(regex.extract(subject.base)[].named_groups['third_section'])"
  subject.base contains "["
  subject.base ends_with "]"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`subject.base`	contains	`[`	`field:"subject.base" kind:contains value:"["`
`subject.base`	ends_with	`]`	`field:"subject.base" kind:ends_with value:"]"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`