detection.wiki

Detection rules › Sublime MQL

Brand Impersonation: Google (QR Code)

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages using Google based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, PDF, QR code

Event coverage

Message attribute
attachments (collection)
body.current_thread
headers (collection)
headers.hops (collection)
sender
sender.email
subject
type

Rule body MQL

type.inbound
and length(body.current_thread.text) < 1000
and any([subject.subject, sender.display_name, body.current_thread.text],
        regex.icontains(.,
                        '(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor|(Auth(enticat|e|or|ion))?)'
        )
)
and (
  any(attachments,
      (
        .file_type in $file_types_images
        or .file_type == "pdf"
        or .file_type in~ $file_extensions_macros
      )
      and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Google"))
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         strings.starts_with(.name, "Google")
  )
)
and any(attachments,
        (
          .file_type in $file_types_images
          or .file_type == "pdf"
          or .file_type in $file_extensions_macros
        )
        and (
          any(file.explode(.),
              regex.icontains(.scan.ocr.raw, 'scan|camera')
              and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
          )
          or any(file.explode(.),
                 .scan.qr.type is not null
                 and regex.contains(.scan.qr.data, '\.')
          )
          or (
            //
            // This rule makes use of a beta feature and is subject to change without notice
            // using the beta feature in custom rules is not suggested until it has been formally released
            //
            beta.parse_exif(file.message_screenshot()).image_height < 2000
            and beta.parse_exif(file.message_screenshot()).image_width < 2000
            and any(beta.scan_qr(file.message_screenshot()).items,
                    .type is not null and regex.contains(.data, '\.')
            )
          )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects messages using Google based lures, referencing or including a QR code from an Unsolicited sender. These messages often lead users to phishing sites or initiate unwanted downloads.

  1. inbound message
  2. length(body.current_thread.text) < 1000
  3. any of [subject.subject, sender.display_name, body.current_thread.text] where:
    • . matches '(\\b2fa\\b|\\bQ.?R\\.?\\s?\\b|MFA|Muti[ -]?Factor|(Auth(enticat|e|or|ion))?)'
  4. any of:
    • any of attachments where all hold:
      • any of:
        • .file_type in $file_types_images
        • .file_type is 'pdf'
        • .file_type in $file_extensions_macros
      • any of ml.logo_detect(.).brands where:
        • .name starts with 'Google'
    • any of ml.logo_detect(file.message_screenshot()).brands where:
      • .name starts with 'Google'
  5. any of attachments where all hold:
    • any of:
      • .file_type in $file_types_images
      • .file_type is 'pdf'
      • .file_type in $file_extensions_macros
    • any of:
      • any of file.explode(.) where all hold:
        • .scan.ocr.raw matches 'scan|camera'
        • .scan.ocr.raw matches '\\bQR\\b|Q\\.R\\.|barcode'
      • any of file.explode(.) where all hold:
        • .scan.qr.type is set
        • .scan.qr.data matches '\\.'
      • all of:
        • beta.parse_exif(file.message_screenshot()).image_height < 2000
        • beta.parse_exif(file.message_screenshot()).image_width < 2000
        • any of beta.scan_qr(file.message_screenshot()).items where all hold:
          • .type is set
          • .data matches '\\.'
  6. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  7. not:
    • profile.by_sender().any_messages_benign
  8. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • any of distinct(headers.hops) where:
        • .authentication_results.dmarc matches '*fail'
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].file_type, body.current_thread.text, headers.hops, headers.hops[].authentication_results.dmarc, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.parse_exif, beta.scan_qr, file.explode, file.message_screenshot, ml.logo_detect, profile.by_sender, regex.contains, regex.icontains, strings.ilike, strings.starts_with. Reference lists: $file_extensions_macros, $file_types_images, $high_trust_sender_root_domains.

Indicators matched (7)

FieldMatchValue
regex.icontainsregex(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor|(Auth(enticat|e|or|ion))?)
attachments[].file_typeequalspdf
strings.starts_withprefixGoogle
regex.icontainsregexscan|camera
regex.icontainsregex\bQR\b|Q\.R\.|barcode
regex.containsregex\.
strings.ilikesubstring*fail