Detection rules › Sublime MQL
Sublime MQL rules: sus
| Rule | Severity |
|---|---|
| Link: Mixed case HTTPS protocol | medium |
| Spam: Suspicious toll-free phone number | low |
Link: Mixed case HTTPS protocol
#Detects messages containing links with mixed case 'hTTPs' protocol, a technique used to evade detection filters.
Threat Classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message Attributes
bodybody.linkstype
Rule Body
type.inbound
and length(body.links) > 0
and any(body.links, strings.contains(.href_url.url, 'hTTPs://'))
Detection Logic
Scope: inbound message.
Detects messages containing links with mixed case 'hTTPs' protocol, a technique used to evade detection filters.
- inbound message
- length(body.links) > 0
any of
body.linkswhere:- .href_url.url contains 'hTTPs://'
Inspects: body.links, body.links[].href_url.url, type.inbound. Sensors: strings.contains.
Indicators Matched (1)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | hTTPs:// |
Stages and Predicates
Stage 1: mql_rule
and
any(body.links)
body.links.href_url.url contains "hTTPs://"
body.links length_compare "0"
type.inbound eq "true"Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
type.inbound | eq |
| field:"type.inbound" kind:eq value:"true" |
Spam: Suspicious toll-free phone number
#Detects messages containing phone numbers 1 800-555-0199 or 1 800-555-0299 in the subject or body, which is reserved for use by the entertainment industry. Commonly used as a placeholder phone number in LLM-generated campaigns.
Threat Classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Social engineering |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message Attributes
bodybody.current_threadsubjecttype
Rule Body
type.inbound
and any([body.current_thread.text, subject.subject],
regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b')
)
Detection Logic
Scope: inbound message.
Detects messages containing phone numbers 1 800-555-0199 or 1 800-555-0299 in the subject or body, which is reserved for use by the entertainment industry. Commonly used as a placeholder phone number in LLM-generated campaigns.
- inbound message
- any([body.current_thread.text, subject.subject], regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b') )
Inspects: body.current_thread.text, subject.subject, type.inbound. Sensors: regex.icontains.
Indicators Matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b |
Stages and Predicates
Stage 1: mql_rule
and
type.inbound eq "true"
macro "any([body.current_thread.text, subject.subject],\n regex.icontains(., '\\b\\+?(\\d{1}.)?\\(?8\\d{2}?\\)?.555.?0[12]99\\b')\n)"Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
type.inbound | eq |
| field:"type.inbound" kind:eq value:"true" |