Detection rules › Sublime MQL
Subject and sender display name contains matching long alphanumeric string
Detects messages where both the subject line and sender display name contain identical alphanumeric strings that are between 32 and 64 characters, which may indicate automated generation or coordination between these fields for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(regex.iextract(subject.subject,
'[^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9])'
),
strings.contains(sender.display_name, .named_groups["string"])
)
Detection logic
Scope: inbound message.
Detects messages where both the subject line and sender display name contain identical alphanumeric strings that are between 32 and 64 characters, which may indicate automated generation or coordination between these fields for malicious purposes.
- inbound message
any of
regex.iextract(subject.subject)where:- strings.contains(sender.display_name)
Inspects: sender.display_name, subject.subject, type.inbound. Sensors: regex.iextract, strings.contains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.iextract | regex | [^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9]) |