Sublime Security critical experimental mql

DLP - Clear-Text Credentials Outbound

Detects outbound emails containing clear-text credentials in the body, subject, or attachments using ML extraction. Covers private keys, AWS access keys, GitHub tokens, HTTP Basic auth headers, and OAuth client secrets. Attachment content is scanned via ml_extract on both raw text and OCR surfaces, catching credentials embedded in images or binary document formats. Note: GCP API keys, Slack tokens, JWTs, and database connection strings are not covered by ml_extract and are intentionally omitted to avoid regex FPs.

View Source

Detection Logic

type.outbound
and (
    // ── ML extraction: body ────────────────────────────────────────────────

    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── ML extraction: subject ─────────────────────────────────────────────

    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
        .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
        and .confidence in ("medium", "high")
    )

    // ── Credential-bearing file types by extension and name ────────────────

    or any(attachments,
        .file_extension in~ ("env", "pem", "key", "p12", "pfx", "jks", "keystore", "ovpn")
        or strings.icontains(.file_name, "credential")
        or strings.icontains(.file_name, "secret")
        or strings.icontains(.file_name, "password")
    )

    // ── ML extraction: attachments (raw text + OCR) ────────────────────────

    or any(attachments,
        any(file.explode(.),
            any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
            or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
                .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret")
                and .confidence in ("medium", "high")
            )
        )
    )
)

Field Validations

Loading…

Comments (0)

Loading comments...