detection.wiki

Detection rules › Sublime MQL

Attachment: RFP/RFQ impersonating government entities

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Attached RFP/RFQ impersonates a U.S. government department or entity to commit fraudulent transactions.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesImpersonation: Brand, PDF, Social engineering

Event coverage

Message attribute
attachments (collection)
body.current_thread
sender.email
subject
type

Rule body MQL

type.inbound
and length(attachments) == 1
and all(attachments,
        .file_extension in~ $file_extensions_macros or .file_type == "pdf"
)
and regex.icontains(body.current_thread.text, "department of|office of")
and (
  regex.icontains(subject.subject,
                  '(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b)'
  )
  or any(attachments,
         regex.icontains(.file_name,
                         '(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b)'
         )
  )
)
and strings.icontains(sender.email.domain.domain, "gov")
and (
  any(ml.nlu_classifier(body.current_thread.text).tags,
      .name == "purchase_order"
  )
  and any(attachments,
          any(file.explode(.),
              any(ml.nlu_classifier(.scan.ocr.raw).entities,
                  regex.icontains(.text, "department of|office of")
              )
          )
  )
)

Detection logic

Scope: inbound message.

Attached RFP/RFQ impersonates a U.S. government department or entity to commit fraudulent transactions.

  1. inbound message
  2. length(attachments) is 1
  3. all of attachments where any holds:
    • .file_extension in $file_extensions_macros
    • .file_type is 'pdf'
  4. body.current_thread.text matches 'department of|office of'
  5. any of:
    • subject.subject matches '(request for (purchase|quot(e|ation))|\\bRFQ\\b|\\bRFP\\b)'
    • any of attachments where:
      • .file_name matches '(request for (purchase|quot(e|ation))|\\bRFQ\\b|\\bRFP\\b)'
  6. sender.email.domain.domain contains 'gov'
  7. all of:
    • any of ml.nlu_classifier(body.current_thread.text).tags where:
      • .name is 'purchase_order'
    • any of attachments where:
      • any of file.explode(.) where:
        • any of ml.nlu_classifier(.scan.ocr.raw).entities where:
          • .text matches 'department of|office of'

Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, body.current_thread.text, sender.email.domain.domain, subject.subject, type.inbound. Sensors: file.explode, ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $file_extensions_macros.

Indicators matched (5)

FieldMatchValue
attachments[].file_typeequalspdf
regex.icontainsregexdepartment of|office of
regex.icontainsregex(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b)
strings.icontainssubstringgov
ml.nlu_classifier(body.current_thread.text).tags[].nameequalspurchase_order