March 2023 Summaries

Sublime's Message Query Language (MQL) is an interface designed to help detect and prevent email attacks through sophisticated logic and is particularly effective against credential phishing. One of its key components, LinkAnalysis, identifies suspicious links by navigating to web pages, capturing screenshots, and analyzing them with techniques like computer vision to determine if they are phishing sites. This process involves a context classifier to evaluate link authenticity, an automated headless browser to visit websites, and deep learning object detection models to identify elements such as logos and input boxes on a page. The system further employs Siamese Neural Networks and optical character recognition for recognizing brand impersonations, while Pixel Math logic assesses if detected input boxes are part of login portals. By combining these technologies, MQL provides robust defense mechanisms against phishing by automatically identifying, flagging, and preventing potential threats before they can harm users.

Sublime is an innovative open email security platform that allows users to write, execute, and share security rules using a universal domain-specific language called Message Query Language (MQL). MQL is designed for detecting and mitigating a range of email threats, like Business Email Compromise and credential phishing, and is used by the Sublime team to address emerging threats effectively. The language is intuitive and flexible, enabling defenders to create custom rules, modify existing ones, and leverage community-shared rules. Central to its operation is the Message Data Model (MDM), which converts the traditional EML email format into a structured schema, simplifying the process of rule creation by using JSON representations for fields like attachments and headers. MQL's syntax is user-friendly, utilizing plain English terms and offering functions for various operations like domain checks and regular expressions. The platform also features an interactive editor built on Visual Studio Code's core, providing tools like autocompletion, diagnostics, and testing capabilities to ensure effective rule development and deployment. Through an accessible interface and comprehensive features, Sublime empowers defenders to enhance email security systematically and collaboratively.