Detection rules › Sublime MQL

Sublime MQL rules: job

Rule	Severity
Job scam with specific salary pattern	`low`

Job scam with specific salary pattern

Severity: low
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects job scam content that includes specific weekly salary mentions (e.g., '$XXX weekly' patterns) in either the current email thread or previous thread conversations, while excluding legitimate income verification services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud
Tactics and techniques	Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
body.previous_threads
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and (
  (
    // job scam in current thread
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("job_scam") and .confidence != "low"
    )
    // and salary mention in current thread
    and regex.icontains(body.current_thread.text,
                        '\$\d{3} weekly',
                        'week \$\d{3}',
                        'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
    )
  )
  // job scam in previous thread
  or any(body.previous_threads,
         any(ml.nlu_classifier(.text).intents,
             .name in ("job_scam") and .confidence != "low"
         )
         // and salary mention in previous thread
         and regex.icontains(.text,
                             '\$\d{3} weekly',
                             'week \$\d{3}',
                             'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
         )
  )
  // job scam lure delivered as a PDF with an empty email body
  or (
    length(body.current_thread.text) == 0
    and length(attachments) == 1
    and any(filter(attachments, .file_type == "pdf"),
            any(file.explode(.),
                // specific weekly salary pattern in the OCR
                regex.icontains(.scan.ocr.raw,
                                '\$\d{3} week',
                                'week \$\d{3}',
                                'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
                )
                and regex.icontains(.scan.ocr.raw,
                                    'fully remote',
                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
                                    'remotely',
                                    'work[\s-]?from[\s-]?home',
                                    'equal opportunity employer',
                                    'how to apply',
                                    'submit (?:your )?application',
                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
                                    'remotely',
                                    'work[\s-]?from[\s-]?home',
                                    'equal opportunity employer',
                                    'how to apply',
                                    'submit (?:your )?application',
                                    'open to all (?:majors|backgrounds|students)',
                                    'employment opportunity',
                                    '\bhiring\b'
                )
                and not regex.icontains(.scan.ocr.raw,
                                        'unemployment',
                                        'monetary (?:re)?determination',
                                        'weekly benefit amount',
                                        'supplemental unemployment',
                                        'work search activit'
                )
            )
    )
  )
)
and length(body.current_thread.links) < 10

// negating income / job verification senders
and not (
  sender.email.domain.root_domain in (
    'loandepot.com',
    'sofi.com',
    'lensa.com',
    'indeed.com',
    'ziprecruiter.com',
    'glassdoor.com',
    'postjobfree.com',
    'jobplacements.com'
  )
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

inbound message
any of:
- all of:
  - any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    
    .name in ('job_scam')
    .confidence is not 'low'
  - body.current_thread.text matches any of 3 patterns
    
    \$\d{3} weekly
    week \$\d{3}
    weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]
- any of body.previous_threads where all hold:
  - any of ml.nlu_classifier(.text).intents where all hold:
    
    .name in ('job_scam')
    .confidence is not 'low'
  - .text matches any of 3 patterns
    
    \$\d{3} weekly
    week \$\d{3}
    weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]
- all of:
  - length(body.current_thread.text) is 0
  - length(attachments) is 1
  - any of filter(attachments) where:
    
    any of file.explode(.) where all hold:
    
    .scan.ocr.raw matches any of 3 patterns
    
    \$\d{3} week
    week \$\d{3}
    weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]
    .scan.ocr.raw matches any of 16 patterns
    
    fully remote
    remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)
    remotely
    work[\s-]?from[\s-]?home
    equal opportunity employer
    how to apply
    submit (?:your )?application
    remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)
    remotely
    work[\s-]?from[\s-]?home
    equal opportunity employer
    how to apply
    submit (?:your )?application
    open to all (?:majors|backgrounds|students)
    employment opportunity
    \bhiring\b
    not:
    
    .scan.ocr.raw matches any of 5 patterns
    
    unemployment
    monetary (?:re)?determination
    weekly benefit amount
    supplemental unemployment
    work search activit
length(body.current_thread.links) < 10
not:
- all of:
  - sender.email.domain.root_domain in ('loandepot.com', 'sofi.com', 'lensa.com', 'indeed.com', 'ziprecruiter.com', 'glassdoor.com', 'postjobfree.com', 'jobplacements.com')
  - headers.auth_summary.dmarc.pass

Inspects: attachments[].file_type, body.current_thread.links, body.current_thread.text, body.previous_threads, body.previous_threads[].text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.nlu_classifier, regex.icontains.

Indicators matched (17)

Field	Match	Value
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`job_scam`
`regex.icontains`	regex	`\$\d{3} weekly`
`regex.icontains`	regex	`week \$\d{3}`
`regex.icontains`	regex	`weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]`
`ml.nlu_classifier(body.previous_threads[].text).intents[].name`	member	`job_scam`
`attachments[].file_type`	equals	`pdf`
`regex.icontains`	regex	`\$\d{3} week`
`regex.icontains`	regex	`fully remote`
`regex.icontains`	regex	`remote\b[\s-]*(?:work\|position\|role\|job\|employee\|worker\|assistant\|opportunit)`
`regex.icontains`	regex	`remotely`
`regex.icontains`	regex	`work[\s-]?from[\s-]?home`
`regex.icontains`	regex	`equal opportunity employer`

5 more

`regex.icontains`	regex	`how to apply`
`regex.icontains`	regex	`submit (?:your )?application`
`regex.icontains`	regex	`open to all (?:majors\|backgrounds\|students)`
`regex.icontains`	regex	`employment opportunity`
`regex.icontains`	regex	`\bhiring\b`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      any(filter(attachments))
        any(file.explode(filter(attachments)))
          and
            not
              or
                file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "monetary (?:re)?determination"
                file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "supplemental unemployment"
                file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "unemployment"
                file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "weekly benefit amount"
                file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "work search activit"
            or
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "\\$\\d{3} week"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "week \\$\\d{3}"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "weekly(?:\\s+\\w+){0,4}\\s+\\$\\d{3}[^\\d]"
            or
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "\\bhiring\\b"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "employment opportunity"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "equal opportunity employer"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "fully remote"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "how to apply"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "open to all (?:majors|backgrounds|students)"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "remote\\b[\\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "remotely"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "submit (?:your )?application"
              file.explode(filter(attachments)[])[].scan.ocr.raw regex_match "work[\\s-]?from[\\s-]?home"
      attachments length_compare "1"
      body.current_thread.text length_compare "0"
    any(body.previous_threads)
      and
        any(ml.nlu_classifier(body.previous_threads.text).intents)
          and
            ml.nlu_classifier(body.previous_threads[].text).intents[].confidence ne "low"
            ml.nlu_classifier(body.previous_threads[].text).intents[].name eq "job_scam"
        or
          body.previous_threads.text regex_match "\\$\\d{3} weekly"
          body.previous_threads.text regex_match "week \\$\\d{3}"
          body.previous_threads.text regex_match "weekly(?:\\s+\\w+){0,4}\\s+\\$\\d{3}[^\\d]"
    and
      any(ml.nlu_classifier(body.current_thread.text).intents)
        and
          ml.nlu_classifier(body.current_thread.text).intents.confidence ne "low"
          ml.nlu_classifier(body.current_thread.text).intents.name eq "job_scam"
      or
        body.current_thread.text regex_match "\\$\\d{3} weekly"
        body.current_thread.text regex_match "week \\$\\d{3}"
        body.current_thread.text regex_match "weekly(?:\\s+\\w+){0,4}\\s+\\$\\d{3}[^\\d]"
  not
    and
      headers.auth_summary.dmarc.pass eq "true"
      sender.email.domain.root_domain in ["glassdoor.com", "indeed.com", "jobplacements.com", "lensa.com", "loandepot.com", "postjobfree.com", "sofi.com", "ziprecruiter.com"]
  body.current_thread.links length_compare "10"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`$\d{3} weekly` `week $\d{3}` `weekly(?:\s+\w+){0,4}\s+$\d{3}[^\d]`	`field:"body.current_thread.text" kind:regex_match`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`headers.auth_summary.dmarc.pass`	eq	`true`	`excludes:headers.auth_summary.dmarc.pass` `field:"headers.auth_summary.dmarc.pass" value:"true"`
`sender.email.domain.root_domain`	in	`glassdoor.com`, `indeed.com`, `jobplacements.com`, `lensa.com`, `loandepot.com`, `postjobfree.com`, `sofi.com`, `ziprecruiter.com`	`excludes:sender.email.domain.root_domain`