Sublime Security medium experimental mql

Suspicious recipients pattern with NLU credential theft indicators

Detects messages with undisclosed recipients (likely all bcc) and NLU identified a credential theft intent with medium to high confidence from a suspicious low reputation link domain

View Source

Detection Logic

type.inbound
and (
  length(recipients.to) == 0
  or all(recipients.to, strings.ilike(.display_name, "undisclosed?recipients"))
)
and length(recipients.cc) == 0
and 0 <= length(recipients.bcc) <= 1
and any(body.links, .href_url.domain.root_domain not in $tranco_1m)
and (
  any(body.links,
      regex.icontains(.display_text,
                      '(view
| click
| download
| goto)?(attachment
| download
| file
| online
| document)s?'
      )
      or all(body.links, regex.match(.display_text, "[A-Z ]+"))
  )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence in ("medium", "high")
)

Field Validations

Loading…

Comments (0)

Loading comments...