Detection rules › Sublime MQL
Body: Embedded email headers indicative of thread hijacking/abuse
Detects email headers embedded in the message body content, indicating forwarded phishing attempts, MIME boundary manipulation, delivery notification spoofing, or copy-paste phishing. This pattern is commonly seen when attackers forward legitimate emails and the headers get included in the body, or when spoofing system notifications.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud, Spam |
| Tactics and techniques | Evasion, Social engineering, Spoofing |
Event coverage
Rule body MQL
type.inbound
// Headers are in the body.plain.raw but not the body.html.raw
and 2 of (
strings.icontains(body.plain.raw, "Delivered-To:")
and not strings.icontains(body.html.raw, "Delivered-To:"),
strings.icontains(body.plain.raw, "X-Google-Smtp-Source:")
and not strings.icontains(body.html.raw, "X-Google-Smtp-Source:"),
strings.icontains(body.plain.raw, "ARC-Seal: i=")
and not strings.icontains(body.html.raw, "ARC-Seal: i="),
)
and 1 of (
regex.icontains(body.plain.raw, "Received: by .{10,80} with SMTP id")
and not regex.icontains(body.html.raw, "Received: by .{10,80} with SMTP id"),
regex.icontains(body.plain.raw, "X-Received: by .{10,80} with SMTP id")
and not regex.icontains(body.html.raw, "X-Received: by .{10,80} with SMTP id"),
)
// Negate legitimate forwards where users intentionally include headers
and not (
(length(headers.references) > 0 or headers.in_reply_to is not null)
and (subject.is_forward or subject.is_reply)
and length(body.previous_threads) >= 1
)
// Sender is not from org or high trust domains
and sender.email.domain.root_domain not in $org_domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects email headers embedded in the message body content, indicating forwarded phishing attempts, MIME boundary manipulation, delivery notification spoofing, or copy-paste phishing. This pattern is commonly seen when attackers forward legitimate emails and the headers get included in the body, or when spoofing system notifications.
- inbound message
at least 2 of:
all of:
- body.plain.raw contains 'Delivered-To:'
not:
- body.html.raw contains 'Delivered-To:'
all of:
- body.plain.raw contains 'X-Google-Smtp-Source:'
not:
- body.html.raw contains 'X-Google-Smtp-Source:'
all of:
- body.plain.raw contains 'ARC-Seal: i='
not:
- body.html.raw contains 'ARC-Seal: i='
at least 1 of:
all of:
- body.plain.raw matches 'Received: by .{10,80} with SMTP id'
not:
- body.html.raw matches 'Received: by .{10,80} with SMTP id'
all of:
- body.plain.raw matches 'X-Received: by .{10,80} with SMTP id'
not:
- body.html.raw matches 'X-Received: by .{10,80} with SMTP id'
not:
all of:
any of:
- length(headers.references) > 0
- headers.in_reply_to is set
any of:
- subject.is_forward
- subject.is_reply
- length(body.previous_threads) ≥ 1
- sender.email.domain.root_domain not in $org_domains
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.html.raw, body.plain.raw, body.previous_threads, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.is_forward, subject.is_reply, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains, $org_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | Delivered-To: |
strings.icontains | substring | X-Google-Smtp-Source: |
strings.icontains | substring | ARC-Seal: i= |
regex.icontains | regex | Received: by .{10,80} with SMTP id |
regex.icontains | regex | X-Received: by .{10,80} with SMTP id |