Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Free email provider, Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
sender.display_name =~ 'KnowBe4'
or strings.ilevenshtein(sender.display_name, 'KnowBe4') <= 1
or strings.icontains(sender.email.domain.domain, '*KnowBe4*')
)
and (
sender.email.domain.root_domain not in ('knowbe4.com')
or (
sender.email.domain.root_domain in ('knowbe4.com')
and not headers.auth_summary.dmarc.pass
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of KnowBe4.
- inbound message
any of:
- sender.display_name is 'KnowBe4'
- sender.display_name is similar to 'KnowBe4'
- sender.email.domain.domain contains '*KnowBe4*'
any of:
- sender.email.domain.root_domain not in ('knowbe4.com')
all of:
- sender.email.domain.root_domain in ('knowbe4.com')
not:
- headers.auth_summary.dmarc.pass
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: strings.icontains, strings.ilevenshtein. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.display_name | equals | KnowBe4 |
strings.ilevenshtein | fuzzy | KnowBe4 |
strings.icontains | substring | *KnowBe4* |
sender.email.domain.root_domain | member | knowbe4.com |