Detection rules › Sublime MQL

Fake shipping notification with suspicious language

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Body contains keywords for shipping, contains suspicious language, and addresses the recipient by their email, which is an indicator of phishing and/or spam.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Spam
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
// contains at least 1 link
and length(body.links) > 0
and 3 of (
  strings.ilike(body.current_thread.text, "*(1)*"),
  strings.ilike(body.current_thread.text, "*waiting for delivery*"),
  strings.ilike(body.current_thread.text, "*delivery missed*"),
  strings.ilike(body.current_thread.text, "*tracking number*")
)

// urgent/time-sensitive language
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "urgency"
)

// email is not personalized with recipients name
and any(recipients.to,
        any(ml.nlu_classifier(body.current_thread.text).entities,
            .text == ..email.local_part
        )
)

Detection logic

Scope: inbound message.

Body contains keywords for shipping, contains suspicious language, and addresses the recipient by their email, which is an indicator of phishing and/or spam.

  1. inbound message
  2. length(body.links) > 0
  3. at least 3 of 4: body.current_thread.text matches any of 4 patterns
    • *(1)*
    • *waiting for delivery*
    • *delivery missed*
    • *tracking number*
  4. any of ml.nlu_classifier(body.current_thread.text).entities where:
    • .name is 'urgency'
  5. any of recipients.to where:
    • any of ml.nlu_classifier(body.current_thread.text).entities where:
      • .text is .email.local_part

Inspects: body.current_thread.text, body.links, recipients.to, recipients.to[].email.local_part, type.inbound. Sensors: ml.nlu_classifier, strings.ilike.

Indicators matched (5)

FieldMatchValue
strings.ilikesubstring*(1)*
strings.ilikesubstring*waiting for delivery*
strings.ilikesubstring*delivery missed*
strings.ilikesubstring*tracking number*
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsurgency