Detection rules › Sublime MQL
Suspicious sender display name with long procedurally generated text blob
This rule identifies sender display names containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and regex.icontains(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not regex.icontains(sender.display_name, '_bot_[a-f0-9]{32}\)')
and not regex.match(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not (sender.email.email == "" or sender.email.domain.valid == false)
// negate org domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $org_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $org_domains
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
This rule identifies sender display names containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.
- inbound message
- sender.display_name matches '\\b[\\w\\p{L}\\p{N}]{35,}\\b'
not:
- sender.display_name matches '_bot_[a-f0-9]{32}\\)'
not:
- sender.display_name matches '\\b[\\w\\p{L}\\p{N}]{35,}\\b'
none of:
- sender.email.email is ''
- sender.email.domain.valid is False
any of:
all of:
- sender.email.domain.root_domain in $org_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $org_domains
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender_email().any_messages_benign
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, sender.email.domain.valid, sender.email.email, type.inbound. Sensors: profile.by_sender_email, regex.icontains, regex.match. Reference lists: $high_trust_sender_root_domains, $org_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \b[\w\p{L}\p{N}]{35,}\b |
regex.icontains | regex | _bot_[a-f0-9]{32}\) |
regex.match | regex | \b[\w\p{L}\p{N}]{35,}\b |
sender.email.email | equals | |