Detection rules › Sublime MQL

Suspicious subject with long procedurally generated text blob

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule identifies subjects containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Spam
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
// "#" symbol, and then letters, numbers or more symbols (-#)
and regex.imatch(subject.subject, ".*#[a-z0-9-#]+$")
// not JUST letters
and not regex.imatch(subject.subject, ".*#[a-z-]+$")
// not JUST numbers
and not regex.imatch(subject.subject, ".*#[0-9-]+$")
and not any(beta.ml_topic(body.current_thread.text).topics,
            .name in (
              "Professional and Career Development",
              "Reminders and Notifications"
            )
            and .confidence == "high"
)

// and 1 other suspicious element
and 2 of (
  any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld)),
  (
    regex.imatch(sender.display_name, ".*#[a-z0-9-#]+$")
    and not regex.imatch(subject.subject, ".*#[a-z-]+$")
    and not regex.imatch(subject.subject, ".*#[0-9-]+$")
  ),
  any(ml.nlu_classifier(subject.subject).intents,
      .name == "cred_theft" and .confidence == "high"
  ),
  body.current_thread.text is null
)

// standard negations
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

This rule identifies subjects containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.

  1. inbound message
  2. subject.subject matches '.*#[a-z0-9-#]+$'
  3. not:
    • subject.subject matches '.*#[a-z-]+$'
  4. not:
    • subject.subject matches '.*#[0-9-]+$'
  5. not:
    • any of beta.ml_topic(body.current_thread.text).topics where all hold:
      • .name in ('Professional and Career Development', 'Reminders and Notifications')
      • .confidence is 'high'
  6. at least 2 of:
    • any of recipients.to where:
      • strings.icontains(sender.display_name)
    • all of:
      • sender.display_name matches '.*#[a-z0-9-#]+$'
      • not:
        • subject.subject matches '.*#[a-z-]+$'
      • not:
        • subject.subject matches '.*#[0-9-]+$'
    • any of ml.nlu_classifier(subject.subject).intents where all hold:
      • .name is 'cred_theft'
      • .confidence is 'high'
    • body.current_thread.text is missing
  7. not:
    • profile.by_sender_email().any_messages_benign
  8. not:
    • profile.by_sender_email().solicited
  9. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.domain.sld, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier, profile.by_sender_email, regex.imatch, strings.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (8)

FieldMatchValue
regex.imatchregex.*#[a-z0-9-#]+$
regex.imatchregex.*#[a-z-]+$
regex.imatchregex.*#[0-9-]+$
beta.ml_topic(body.current_thread.text).topics[].namememberProfessional and Career Development
beta.ml_topic(body.current_thread.text).topics[].namememberReminders and Notifications
beta.ml_topic(body.current_thread.text).topics[].confidenceequalshigh
ml.nlu_classifier(subject.subject).intents[].nameequalscred_theft
ml.nlu_classifier(subject.subject).intents[].confidenceequalshigh