Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Free email provider, Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
regex.icontains(sender.display_name, '\bhulu\b')
or (
strings.ilevenshtein(sender.display_name, 'hulu') <= 1
and not (
// lulu.com is a self publisher
sender.display_name =~ "lulu"
and sender.email.domain.root_domain == "lulu.com"
)
and not (
// hudu.com is an IT documentation management platform
sender.display_name =~ "hudu"
and sender.email.domain.root_domain == "hudu.com"
)
)
or strings.ilike(sender.email.domain.domain, '*hulu*')
or (
(
length(recipients.to) == 0
or (
all(recipients.to, .email.domain.valid == false)
and all(recipients.cc, .email.domain.valid == false)
)
)
and any(ml.logo_detect(file.message_screenshot()).brands,
.name == "Hulu" and .confidence in ("medium", "high")
)
)
)
and (
sender.email.domain.root_domain not in (
'hulu.com',
'hulumail.com',
'hulu.jp',
'hulu-japan.jp'
)
or (
sender.email.domain.root_domain in (
'hulu.com',
'hulumail.com',
'hulu.jp',
'hulu-japan.jp'
)
and not headers.auth_summary.dmarc.pass
)
)
and not profile.by_sender().solicited
Detection logic
Scope: inbound message.
Impersonation of Hulu.
- inbound message
any of:
- sender.display_name matches '\\bhulu\\b'
all of:
- sender.display_name is similar to 'hulu'
not:
all of:
- sender.display_name is 'lulu'
- sender.email.domain.root_domain is 'lulu.com'
not:
all of:
- sender.display_name is 'hudu'
- sender.email.domain.root_domain is 'hudu.com'
- sender.email.domain.domain matches '*hulu*'
all of:
any of:
- length(recipients.to) is 0
all of:
all of
recipients.towhere:- .email.domain.valid is False
all of
recipients.ccwhere:- .email.domain.valid is False
any of
ml.logo_detect(file.message_screenshot()).brandswhere all hold:- .name is 'Hulu'
- .confidence in ('medium', 'high')
any of:
- sender.email.domain.root_domain not in ('hulu.com', 'hulumail.com', 'hulu.jp', 'hulu-japan.jp')
all of:
- sender.email.domain.root_domain in ('hulu.com', 'hulumail.com', 'hulu.jp', 'hulu-japan.jp')
not:
- headers.auth_summary.dmarc.pass
not:
- profile.by_sender().solicited
Inspects: headers.auth_summary.dmarc.pass, recipients.cc, recipients.cc[].email.domain.valid, recipients.to, recipients.to[].email.domain.valid, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, profile.by_sender, regex.icontains, strings.ilevenshtein, strings.ilike.
Indicators matched (14)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \bhulu\b |
strings.ilevenshtein | fuzzy | hulu |
sender.display_name | equals | lulu |
sender.email.domain.root_domain | equals | lulu.com |
sender.display_name | equals | hudu |
sender.email.domain.root_domain | equals | hudu.com |
strings.ilike | substring | *hulu* |
ml.logo_detect(file.message_screenshot()).brands[].name | equals | Hulu |
ml.logo_detect(file.message_screenshot()).brands[].confidence | member | medium |
ml.logo_detect(file.message_screenshot()).brands[].confidence | member | high |
sender.email.domain.root_domain | member | hulu.com |
sender.email.domain.root_domain | member | hulumail.com |
2 more
sender.email.domain.root_domain | member | hulu.jp |
sender.email.domain.root_domain | member | hulu-japan.jp |