Mass campaign: recipient address in subject, body, and link (untrusted sender)

calendar Jan 12, 2026  ·
Share on: linkedin copy

This detects a pattern commonly observed in mass phishing campaigns.

The local_part or the full email address of the recipient is used in the subject, body, and link query parameter to "personalize" the attack.

Sublime rule (View on GitHub)

 1name: "Mass campaign: recipient address in subject, body, and link (untrusted sender)"
 2description: |
 3  This detects a pattern commonly observed in mass phishing campaigns.
 4
 5  The local_part or the full email address of the recipient is used in the subject,
 6  body, and link query parameter to "personalize" the attack.  
 7references:
 8  - "https://playground.sublimesecurity.com?id=d9143109-8886-4639-b634-d0a671848eb6"
 9type: "rule"
10severity: "medium"
11source: |
12  type.inbound
13  and length(recipients.to) + length(recipients.bcc) + length(recipients.cc) == 1
14  
15  // exclude To: Undisclosed recipients:;
16  // since we won't have a valid recipient email
17  and any(recipients.to, .email.domain.valid == true)
18  and (
19    profile.by_sender().prevalence in ("new", "outlier")
20    or (
21      profile.by_sender().any_messages_malicious_or_spam
22      and not profile.by_sender().any_messages_benign
23    )
24  )
25  and (
26    any(recipients.to,
27        (
28          strings.icontains(subject.subject, .email.email)
29          or strings.icontains(subject.subject, .email.local_part)
30        )
31        and (
32          .email.domain.valid or strings.icontains(.display_name, "undisclosed")
33        )
34    )
35  )
36  and any(recipients.to,
37          strings.icontains(body.current_thread.text, .email.email)
38  )
39  and any(body.links,
40          any(recipients.to,
41              strings.icontains(..href_url.query_params, .email.email)
42          )
43          and (
44            (
45              not strings.icontains(.display_text, "unsubscribe")
46              and not strings.icontains(.href_url.path, "unsubscribe")
47            )
48          )
49  )
50  and any(ml.nlu_classifier(body.current_thread.text).intents,
51          .name in ("cred_theft") and .confidence == "high"
52  )
53  
54  // negate highly trusted sender domains unless they fail DMARC authentication
55  and (
56    (
57      sender.email.domain.root_domain in $high_trust_sender_root_domains
58      and not headers.auth_summary.dmarc.pass
59    )
60    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
61  )  
62attack_types:
63  - "Credential Phishing"
64tactics_and_techniques:
65  - "Social engineering"
66detection_methods:
67  - "Header analysis"
68  - "Natural Language Understanding"
69  - "Sender analysis"
70id: "599dabf5-6287-5adf-8a8f-70649ccf0f92"
to-top