Detection rules › Sublime MQL

Brand impersonation: Enbridge

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of the Canadian energy company Enbridge.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and (
  strings.ilike(sender.display_name, '*enbridge*')
  or strings.ilike(sender.email.domain.domain, '*enbridge*')
  or strings.ilike(subject.subject, '*enbridge*')
)
and any(body.links,
        strings.ilike(.display_text, "*pay now*", "*view your bill*")
)
// negate replies
and (length(headers.references) == 0 or headers.in_reply_to is null)
and sender.email.domain.root_domain not in~ (
  'enbridge.com',
  'enbridgegas.com',
  // Enbridge Subsidiaries
  'domenergyoheb.com', // Dominion Energy Ohio
  'domenergyuteb.com' // Dominion Energy Utah
)

Detection logic

Scope: inbound message.

Impersonation of the Canadian energy company Enbridge.

  1. inbound message
  2. any of:
    • sender.display_name matches '*enbridge*'
    • sender.email.domain.domain matches '*enbridge*'
    • subject.subject matches '*enbridge*'
  3. any of body.links where:
    • .display_text matches any of 2 patterns
      • *pay now*
      • *view your bill*
  4. any of:
    • length(headers.references) is 0
    • headers.in_reply_to is missing
  5. sender.email.domain.root_domain not in ('enbridge.com', 'enbridgegas.com', 'domenergyoheb.com', 'domenergyuteb.com')

Inspects: body.links, body.links[].display_text, headers.in_reply_to, headers.references, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: strings.ilike.

Indicators matched (7)

FieldMatchValue
strings.ilikesubstring*enbridge*
strings.ilikesubstring*pay now*
strings.ilikesubstring*view your bill*
sender.email.domain.root_domainmemberenbridge.com
sender.email.domain.root_domainmemberenbridgegas.com
sender.email.domain.root_domainmemberdomenergyoheb.com
sender.email.domain.root_domainmemberdomenergyuteb.com