Detection rules › Sublime MQL
Business Email Compromise (BEC) attempt from unsolicited sender
Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Spoofing |
Event coverage
Rule body MQL
type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("bec") and .confidence == "high"
)
and
// mismatched From and Reply-to
(
(
length(headers.reply_to) > 0
and all(headers.reply_to,
.email.domain.root_domain != sender.email.domain.root_domain
)
)
or not headers.auth_summary.dmarc.pass
or not headers.auth_summary.spf.pass
)
// negate "via" senders via dmarc authentication or gmail autoforwards
and not (
strings.ilike(headers.return_path.local_part, "*+caf_=*")
and strings.contains(sender.display_name, "via")
and (headers.auth_summary.dmarc.pass)
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders.
- inbound message
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('bec')
- .confidence is 'high'
any of:
all of:
- length(headers.reply_to) > 0
all of
headers.reply_towhere:- .email.domain.root_domain is not sender.email.domain.root_domain
not:
- headers.auth_summary.dmarc.pass
not:
- headers.auth_summary.spf.pass
not:
all of:
- headers.return_path.local_part matches '*+caf_=*'
- sender.display_name contains 'via'
- headers.auth_summary.dmarc.pass
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.reply_to, headers.reply_to[].email.domain.root_domain, headers.return_path.local_part, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, strings.contains, strings.ilike.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | member | bec |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
strings.ilike | substring | *+caf_=* |
strings.contains | substring | via |