Detection rules › Sublime MQL
Brand impersonation: AliExpress
Detects messages impersonating AliExpress by matching known footer text and social media links, while confirming the sender is not legitimately from AliExpress or its infrastructure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
// the address in the footer
strings.icontains(body.current_thread.text,
'26/F Tower One, Times Square, 1 Matheson Street, Causeway Bay'
)
// the social links in the footer
or (
length(filter(body.links,
strings.icontains(.href_url.url,
'https://www.facebook.com/aliexpressbr'
)
or strings.icontains(.href_url.url,
'https://twitter.com/aliexpressbr'
)
or strings.icontains(.href_url.url,
'https://www.youtube.com/user/AliExpressChannel'
)
or strings.icontains(.href_url.url,
'https://www.instagram.com/aliexpressbr'
)
// whatsapp
or strings.icontains(.href_url.url,
'https://wa.me/8657186563839'
)
// messenger
or strings.icontains(.href_url.url, 'https://m.me/AliExpress')
)
) >= 4
)
)
// not from AliExpress or Alibaba
and not (
sender.email.domain.root_domain in ("aliexpress.com", "alibaba.com")
and headers.auth_summary.dmarc.pass
)
// did not traverse the parent org's mail server
and not (any(headers.domains, .root_domain in ('aliyun-inc.com')))
Detection logic
Scope: inbound message.
Detects messages impersonating AliExpress by matching known footer text and social media links, while confirming the sender is not legitimately from AliExpress or its infrastructure.
- inbound message
any of:
- body.current_thread.text contains '26/F Tower One, Times Square, 1 Matheson Street, Causeway Bay'
- length(filter(body.links, strings.icontains(.href_url.url, 'https://www.facebook.com/aliexpressbr') or strings.icontains(.href_url.url, 'https://twitter.com/aliexpressbr') or strings.icontains(.href_url.url, 'https://www.youtube.com/user/AliExpressChannel') or strings.icontains(.href_url.url, 'https://www.instagram.com/aliexpressbr') or strings.icontains(.href_url.url, 'https://wa.me/8657186563839') or strings.icontains(.href_url.url, 'https://m.me/AliExpress'))) ≥ 4
not:
all of:
- sender.email.domain.root_domain in ('aliexpress.com', 'alibaba.com')
- headers.auth_summary.dmarc.pass
not:
any of
headers.domainswhere:- .root_domain in ('aliyun-inc.com')
Inspects: body.current_thread.text, body.links, body.links[].href_url.url, headers.auth_summary.dmarc.pass, headers.domains, headers.domains[].root_domain, sender.email.domain.root_domain, type.inbound. Sensors: strings.icontains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | 26/F Tower One, Times Square, 1 Matheson Street, Causeway Bay |
strings.icontains | substring | https://www.facebook.com/aliexpressbr |
strings.icontains | substring | https://twitter.com/aliexpressbr |
strings.icontains | substring | https://www.youtube.com/user/AliExpressChannel |
strings.icontains | substring | https://www.instagram.com/aliexpressbr |
strings.icontains | substring | https://wa.me/8657186563839 |
strings.icontains | substring | https://m.me/AliExpress |
sender.email.domain.root_domain | member | aliexpress.com |
sender.email.domain.root_domain | member | alibaba.com |
headers.domains[].root_domain | member | aliyun-inc.com |