Detection rules › Sublime MQL
Suspicious subject with long procedurally generated text blob
This rule identifies subjects containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
// "#" symbol, and then letters, numbers or more symbols (-#)
and regex.imatch(subject.subject, ".*#[a-z0-9-#]+$")
// not JUST letters
and not regex.imatch(subject.subject, ".*#[a-z-]+$")
// not JUST numbers
and not regex.imatch(subject.subject, ".*#[0-9-]+$")
and not any(beta.ml_topic(body.current_thread.text).topics,
.name in (
"Professional and Career Development",
"Reminders and Notifications"
)
and .confidence == "high"
)
// and 1 other suspicious element
and 2 of (
any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld)),
(
regex.imatch(sender.display_name, ".*#[a-z0-9-#]+$")
and not regex.imatch(subject.subject, ".*#[a-z-]+$")
and not regex.imatch(subject.subject, ".*#[0-9-]+$")
),
any(ml.nlu_classifier(subject.subject).intents,
.name == "cred_theft" and .confidence == "high"
),
body.current_thread.text is null
)
// standard negations
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
This rule identifies subjects containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters.
- inbound message
- subject.subject matches '.*#[a-z0-9-#]+$'
not:
- subject.subject matches '.*#[a-z-]+$'
not:
- subject.subject matches '.*#[0-9-]+$'
not:
any of
beta.ml_topic(body.current_thread.text).topicswhere all hold:- .name in ('Professional and Career Development', 'Reminders and Notifications')
- .confidence is 'high'
at least 2 of:
any of
recipients.towhere:- strings.icontains(sender.display_name)
all of:
- sender.display_name matches '.*#[a-z0-9-#]+$'
not:
- subject.subject matches '.*#[a-z-]+$'
not:
- subject.subject matches '.*#[0-9-]+$'
any of
ml.nlu_classifier(subject.subject).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
- body.current_thread.text is missing
not:
- profile.by_sender_email().any_messages_benign
not:
- profile.by_sender_email().solicited
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.domain.sld, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier, profile.by_sender_email, regex.imatch, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
regex.imatch | regex | .*#[a-z0-9-#]+$ |
regex.imatch | regex | .*#[a-z-]+$ |
regex.imatch | regex | .*#[0-9-]+$ |
beta.ml_topic(body.current_thread.text).topics[].name | member | Professional and Career Development |
beta.ml_topic(body.current_thread.text).topics[].name | member | Reminders and Notifications |
beta.ml_topic(body.current_thread.text).topics[].confidence | equals | high |
ml.nlu_classifier(subject.subject).intents[].name | equals | cred_theft |
ml.nlu_classifier(subject.subject).intents[].confidence | equals | high |