detection.wiki

Detection rules › Sublime MQL

Attachment: Fake secure message and suspicious indicators

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Body contains language resembling credential theft, and an attached "secure message" from an untrusted sender.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImage as content, Impersonation: Brand, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers (collection)
headers.auth_summary
headers.domains (collection)
headers.hops (collection)
sender.email
type

Rule body MQL

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
)

// ----- other suspicious signals here -----
and any(attachments,
        any(file.explode(.),
            any(.scan.strings.strings, strings.icontains(., "secure message"))
            and (
              any(.scan.url.urls, .domain.tld in $suspicious_tlds)
              or any(.scan.url.urls,
                     any(.rewrite.encoders,
                         strings.icontains(., "open_redirect")
                     )
              )
            )
            and (
              any(.scan.url.urls,
                  .domain.root_domain != sender.email.domain.root_domain
              )
              or not sender.email.domain.valid
            )
        )
)

// negate legitimate message senders
and (
  (
    sender.email.domain.root_domain not in ("protectedtrust.com")
    or not sender.email.domain.valid
  )
  and any(headers.hops,
          .index == 0
          and not any(.fields,
                      strings.contains(.value,
                                       'multipart/mixed; boundary="PROOFPOINT_BOUNDARY_1"'
                      )
          )
  )
  and not (
    any(headers.hops, any(.fields, .name == 'X-ZixNet'))
    and any(headers.domains,
            .root_domain in ("zixport.com", "zixcorp.com", "zixmail.net")
    )
  )
  and not all(body.links,
              .href_url.domain.root_domain in ("mimecast.com", "cisco.com")
  )
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Body contains language resembling credential theft, and an attached "secure message" from an untrusted sender.

  1. inbound message
  2. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is 'high'
  3. any of attachments where:
    • any of file.explode(.) where all hold:
      • any of .scan.strings.strings where:
        • . contains 'secure message'
      • any of:
        • any of .scan.url.urls where:
          • .domain.tld in $suspicious_tlds
        • any of .scan.url.urls where:
          • any of .rewrite.encoders where:
            • . contains 'open_redirect'
      • any of:
        • any of .scan.url.urls where:
          • .domain.root_domain is not sender.email.domain.root_domain
        • not:
          • sender.email.domain.valid
  4. all of:
    • any of:
      • sender.email.domain.root_domain not in ('protectedtrust.com')
      • not:
        • sender.email.domain.valid
    • any of headers.hops where all hold:
      • .index is 0
      • not:
        • any of .fields where:
          • .value contains 'multipart/mixed; boundary="PROOFPOINT_BOUNDARY_1"'
    • not:
      • all of:
        • any of headers.hops where:
          • any of .fields where:
            • .name is 'X-ZixNet'
        • any of headers.domains where:
          • .root_domain in ('zixport.com', 'zixcorp.com', 'zixmail.net')
    • not:
      • all of body.links where:
        • .href_url.domain.root_domain in ('mimecast.com', 'cisco.com')
  5. any of:
    • all of:
      • profile.by_sender().prevalence in ('new', 'outlier')
      • not:
        • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  6. not:
    • profile.by_sender().any_messages_benign
  7. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, headers.auth_summary.dmarc.pass, headers.domains, headers.domains[].root_domain, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.hops[].index, sender.email.domain.root_domain, sender.email.domain.valid, type.inbound. Sensors: file.explode, ml.nlu_classifier, profile.by_sender, strings.contains, strings.icontains. Reference lists: $high_trust_sender_root_domains, $suspicious_tlds.

Indicators matched (12)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
strings.icontainssubstringsecure message
strings.icontainssubstringopen_redirect
sender.email.domain.root_domainmemberprotectedtrust.com
strings.containssubstringmultipart/mixed; boundary="PROOFPOINT_BOUNDARY_1"
headers.hops[].fields[].nameequalsX-ZixNet
headers.domains[].root_domainmemberzixport.com
headers.domains[].root_domainmemberzixcorp.com
headers.domains[].root_domainmemberzixmail.net
body.links[].href_url.domain.root_domainmembermimecast.com
body.links[].href_url.domain.root_domainmembercisco.com