Detection rules › Sublime MQL
Fake shipping notification with suspicious language
Body contains keywords for shipping, contains suspicious language, and addresses the recipient by their email, which is an indicator of phishing and/or spam.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
// contains at least 1 link
and length(body.links) > 0
and 3 of (
strings.ilike(body.current_thread.text, "*(1)*"),
strings.ilike(body.current_thread.text, "*waiting for delivery*"),
strings.ilike(body.current_thread.text, "*delivery missed*"),
strings.ilike(body.current_thread.text, "*tracking number*")
)
// urgent/time-sensitive language
and any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "urgency"
)
// email is not personalized with recipients name
and any(recipients.to,
any(ml.nlu_classifier(body.current_thread.text).entities,
.text == ..email.local_part
)
)
Detection logic
Scope: inbound message.
Body contains keywords for shipping, contains suspicious language, and addresses the recipient by their email, which is an indicator of phishing and/or spam.
- inbound message
- length(body.links) > 0
at least 3 of 4: body.current_thread.text matches any of 4 patterns
*(1)**waiting for delivery**delivery missed**tracking number*
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'urgency'
any of
recipients.towhere:any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .text is .email.local_part
Inspects: body.current_thread.text, body.links, recipients.to, recipients.to[].email.local_part, type.inbound. Sensors: ml.nlu_classifier, strings.ilike.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *(1)* |
strings.ilike | substring | *waiting for delivery* |
strings.ilike | substring | *delivery missed* |
strings.ilike | substring | *tracking number* |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | urgency |