Mass campaign: recipient address in subject, body, and link (untrusted sender)

calendar Sep 23, 2026  ·
Share on: linkedin copy

This detects a pattern commonly observed in mass phishing campaigns.

The local_part or the full email address of the recipient is used in the subject, body, and link query parameter to "personalize" the attack.

Sublime rule (View on GitHub)

 1name: "Mass campaign: recipient address in subject, body, and link (untrusted sender)"
 2description: |
 3  This detects a pattern commonly observed in mass phishing campaigns.
 4
 5  The local_part or the full email address of the recipient is used in the subject,
 6  body, and link query parameter to "personalize" the attack.  
 7references:
 8  - "https://playground.sublimesecurity.com?id=d9143109-8886-4639-b634-d0a671848eb6"
 9type: "rule"
10severity: "medium"
11source: |
12  type.inbound
13  and length(recipients.to) + length(recipients.bcc) + length(recipients.cc) == 1
14  
15  // exclude To: Undisclosed recipients:;
16  // since we won't have a valid recipient email
17  and any(recipients.to, .email.domain.valid == true)
18  and (
19    profile.by_sender().prevalence in ("new", "outlier")
20    or (
21      profile.by_sender().any_messages_malicious_or_spam
22      and not profile.by_sender().any_messages_benign
23    )
24  )
25  and (
26    any(recipients.to,
27        (
28          strings.icontains(subject.subject, .email.email)
29          or strings.icontains(subject.subject, .email.local_part)
30        )
31        and (
32          .email.domain.valid or strings.icontains(.display_name, "undisclosed")
33        )
34    )
35  )
36  and any(recipients.to,
37          strings.icontains(body.current_thread.text, .email.email)
38  )
39  and any(body.links,
40          any(recipients.to,
41              strings.icontains(..href_url.query_params, .email.email)
42          )
43          and (
44            (
45              not strings.icontains(.display_text, "unsubscribe")
46              and not strings.icontains(.href_url.path, "unsubscribe")
47            )
48          )
49  )
50  and any(ml.nlu_classifier(body.current_thread.text).intents,
51          .name in ("cred_theft") and .confidence == "high"
52  )
53  
54  // negate highly trusted sender domains unless they fail DMARC authentication
55  and not (
56    sender.email.domain.root_domain in $high_trust_sender_root_domains
57    and coalesce(headers.auth_summary.dmarc.pass, false)
58  )  
59attack_types:
60  - "Credential Phishing"
61tactics_and_techniques:
62  - "Social engineering"
63detection_methods:
64  - "Header analysis"
65  - "Natural Language Understanding"
66  - "Sender analysis"
67id: "599dabf5-6287-5adf-8a8f-70649ccf0f92"
to-top