detection.wiki

Detection rules › Sublime MQL

Investor solicitation with organization targeting

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages targeting organizations with investment solicitations that specifically reference the recipient's organization by extracting the organization name and matching it to the recipient's email domain.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesSocial engineering

Event coverage

Message attribute
body.current_thread
headers (collection)
headers.reply_to (collection)
recipients
recipients.to (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and (
  // subject contains recipient's org name
  any(recipients.to,
      strings.icontains(subject.subject, .email.domain.sld)
      and regex.imatch(.email.domain.sld, '.{2,}')
  )
  or
  // body extracts org name matching recipient domain
  any(regex.extract(body.current_thread.text,
                    '(?P<org>[a-zA-Z]{2,20})\s(?:recently\s)?came to our attention'
      ),
      any(recipients.to,
          strings.icontains(.email.domain.domain, ..named_groups["org"])
      )
  )
)
and any(headers.reply_to,
        .email.domain.root_domain != sender.email.domain.root_domain
)
// greeting uses recipient's email local_part
and any(recipients.to,
        (
          strings.icontains(body.current_thread.text,
                            strings.concat("Dear ", .email.local_part)
          )
          or any(regex.extract(.email.local_part, '^(?P<first>[^._]+)'),
                 strings.icontains(body.current_thread.text,
                                   strings.concat("Dear ",
                                                  .named_groups["first"]
                                   )
                 )
          )
        )
)
// financial/investment cold outreach language
and (
  2 of (
    strings.icontains(body.current_thread.text, "alternative investments"),
    strings.icontains(body.current_thread.text, "raising capital"),
    strings.icontains(body.current_thread.text, "came to our attention"),
    strings.icontains(body.current_thread.text, "private markets"),
    strings.icontains(body.current_thread.text, "fundraising"),
    strings.icontains(body.current_thread.text, "investment opportunities"),
    strings.icontains(body.current_thread.text, "introductory"),
    strings.icontains(body.current_thread.text, "commitment size"),
    strings.icontains(body.current_thread.text, "ultra-high-net-worth"),
    strings.icontains(body.current_thread.text, "deployed capital"),
    strings.icontains(body.current_thread.text, "value creation"),
    strings.icontains(body.current_thread.text, "capital planning")
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Financial Communications"
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Out of Band Pivot"
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "B2B Cold Outreach"
    )
  )
)

Detection logic

Scope: inbound message.

Detects messages targeting organizations with investment solicitations that specifically reference the recipient's organization by extracting the organization name and matching it to the recipient's email domain.

  1. inbound message
  2. any of:
    • any of recipients.to where all hold:
      • strings.icontains(subject.subject)
      • .email.domain.sld matches '.{2,}'
    • any of regex.extract(body.current_thread.text) where:
      • any of recipients.to where:
        • strings.icontains(.email.domain.domain)
  3. any of headers.reply_to where:
    • .email.domain.root_domain is not sender.email.domain.root_domain
  4. any of recipients.to where any holds:
    • strings.icontains(body.current_thread.text)
    • any of regex.extract(.email.local_part) where:
      • strings.icontains(body.current_thread.text)
  5. any of:
    • at least 2 of 12: body.current_thread.text contains any of 12 patterns
      • alternative investments
      • raising capital
      • came to our attention
      • private markets
      • fundraising
      • investment opportunities
      • introductory
      • commitment size
      • ultra-high-net-worth
      • deployed capital
      • value creation
      • capital planning
    • all of:
      • any of ml.nlu_classifier(body.current_thread.text).topics where:
        • .name is 'Financial Communications'
      • any of ml.nlu_classifier(body.current_thread.text).topics where:
        • .name is 'Out of Band Pivot'
      • any of ml.nlu_classifier(body.current_thread.text).topics where:
        • .name is 'B2B Cold Outreach'

Inspects: body.current_thread.text, headers.reply_to, headers.reply_to[].email.domain.root_domain, recipients.to, recipients.to[].email.domain.domain, recipients.to[].email.domain.sld, recipients.to[].email.local_part, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.extract, regex.imatch, strings.concat, strings.icontains.

Indicators matched (18)

FieldMatchValue
regex.imatchregex.{2,}
regex.extractregex(?P<org>[a-zA-Z]{2,20})\s(?:recently\s)?came to our attention
regex.extractregex^(?P<first>[^._]+)
strings.icontainssubstringalternative investments
strings.icontainssubstringraising capital
strings.icontainssubstringcame to our attention
strings.icontainssubstringprivate markets
strings.icontainssubstringfundraising
strings.icontainssubstringinvestment opportunities
strings.icontainssubstringintroductory
strings.icontainssubstringcommitment size
strings.icontainssubstringultra-high-net-worth
6 more
strings.icontainssubstringdeployed capital
strings.icontainssubstringvalue creation
strings.icontainssubstringcapital planning
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsFinancial Communications
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsOut of Band Pivot
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsB2B Cold Outreach