Detection rules › Sublime MQL

Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects sextortion attempts leveraging breach data, including names, addresses, phone numbers and frequently using Google Maps/Bing Maps streetview images to bolster confidence and fear.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesFree email provider, PDF, Social engineering, QR code

Event coverage

Rule body MQL

type.inbound

// sender is a freemail domain
and sender.email.domain.root_domain in $free_email_providers

// attachment filename is the same as the subject
and any(attachments,
        (
          strings.ilevenshtein(strings.concat(subject.subject,
                                              ".",
                                              .file_extension
                               ),
                               .file_name
          ) <= 1
        )
        or strings.contains(.file_name, subject.subject)
)

// body contains a US address, or the body is the subject
and (
  regex.icontains(body.current_thread.text,
                  '\d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.?',
                  // a Canadian address
                  '\d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d'
  )
  or subject.subject == body.current_thread.text
)

// there's a PDF attachment with an image at a depth of one, measuring 148x148 and containing a QR code that is a BTC address
and any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                (
                  (.depth == 1 and .flavors.mime == "image/jpeg")
                  and (
                    .scan.exiftool.image_height == 148
                    and .scan.exiftool.image_width == 148
                    and regex.match(.scan.qr.data,
                                    '(1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59})'
                    )
                  )
                )
                or (
                  any(.scan.strings.strings,
                      regex.icontains(.,
                                      'Amount(?:\s*\w+){0,3}\s*:?\s*(?:USD\s*)?(?:\$\s?\d+|\d+\s?\$?)'
                      )
                  )
                  and any(.scan.strings.strings,
                          regex.icontains(.,
                                          '(\bBITCOIN\b|\bBTC\b|\bLTC\b|Wallet)'
                          )
                  )
                )
        )
)

Detection logic

Scope: inbound message.

Detects sextortion attempts leveraging breach data, including names, addresses, phone numbers and frequently using Google Maps/Bing Maps streetview images to bolster confidence and fear.

  1. inbound message
  2. sender.email.domain.root_domain in $free_email_providers
  3. any of attachments where any holds:
    • strings.ilevenshtein(strings.concat(subject.subject, '.', .file_extension)) ≤ 1
    • strings.contains(.file_name)
  4. any of:
    • body.current_thread.text matches any of 2 patterns
      • \d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.?
      • \d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d
    • subject.subject is body.current_thread.text
  5. any of attachments where all hold:
    • .file_type is 'pdf'
    • any of file.explode(.) where any holds:
      • all of:
        • all of:
          • .depth is 1
          • .flavors.mime is 'image/jpeg'
        • all of:
          • .scan.exiftool.image_height is 148
          • .scan.exiftool.image_width is 148
          • .scan.qr.data matches '(1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59})'
      • all of:
        • any of .scan.strings.strings where:
          • . matches 'Amount(?:\\s*\\w+){0,3}\\s*:?\\s*(?:USD\\s*)?(?:\\$\\s?\\d+|\\d+\\s?\\$?)'
        • any of .scan.strings.strings where:
          • . matches '(\\bBITCOIN\\b|\\bBTC\\b|\\bLTC\\b|Wallet)'

Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, body.current_thread.text, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: file.explode, regex.icontains, regex.match, strings.concat, strings.contains, strings.ilevenshtein. Reference lists: $free_email_providers.

Indicators matched (7)

FieldMatchValue
regex.icontainsregex\d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.?
regex.icontainsregex\d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d
attachments[].file_typeequalspdf
file.explode(attachments[])[].flavors.mimeequalsimage/jpeg
regex.matchregex(1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59})
regex.icontainsregexAmount(?:\s*\w+){0,3}\s*:?\s*(?:USD\s*)?(?:\$\s?\d+|\d+\s?\$?)
regex.icontainsregex(\bBITCOIN\b|\bBTC\b|\bLTC\b|Wallet)