Detection rules › Sublime MQL
Brand impersonation: Mailchimp
Detects messages from senders impersonating Mailchimp through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
// display name contains Mailchimp
(
strings.ilike(strings.replace_confusables(sender.display_name),
'*mailchimp*'
)
// levenshtein distance similar to Mailchimp
or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
'mailchimp'
) <= 1
or any(ml.logo_detect(file.message_screenshot()).brands,
.name == "MailChimp" and .confidence == "high"
)
)
)
and (
any(ml.nlu_classifier(body.current_thread.text).topics,
.name in (
"Security and Authentication",
"Secure Message",
"Reminders and Notifications"
)
and .confidence in ("medium", "high")
)
or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
.name in (
"Security and Authentication",
"Secure Message",
"Reminders and Notifications"
)
and .confidence in ("medium", "high")
and beta.ocr(file.message_screenshot()).text != ""
)
or any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence == "high"
)
or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
.name == "cred_theft" and .confidence == "high"
)
)
// and the sender is not in org_domains or from Mailchimp domains and passes auth
and not (
sender.email.domain.root_domain in $org_domains
or (
sender.email.domain.root_domain in ("intuit.com", "mailchimp.com")
and headers.auth_summary.dmarc.pass
)
)
and not strings.ends_with(headers.message_id, ".mailchimp.com>")
// and the sender is not from high trust sender root domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
Detection logic
Scope: inbound message.
Detects messages from senders impersonating Mailchimp through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns.
- inbound message
any of:
- strings.replace_confusables(sender.display_name) matches '*mailchimp*'
- strings.replace_confusables(sender.display_name) is similar to 'mailchimp'
any of
ml.logo_detect(file.message_screenshot()).brandswhere all hold:- .name is 'MailChimp'
- .confidence is 'high'
any of:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name in ('Security and Authentication', 'Secure Message', 'Reminders and Notifications')
- .confidence in ('medium', 'high')
any of
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topicswhere all hold:- .name in ('Security and Authentication', 'Secure Message', 'Reminders and Notifications')
- .confidence in ('medium', 'high')
- beta.ocr(file.message_screenshot()).text is not ''
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
any of
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
none of:
- sender.email.domain.root_domain in $org_domains
all of:
- sender.email.domain.root_domain in ('intuit.com', 'mailchimp.com')
- headers.auth_summary.dmarc.pass
not:
- headers.message_id ends with '.mailchimp.com>'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender().solicited
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.message_id, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: beta.ocr, file.message_screenshot, ml.logo_detect, ml.nlu_classifier, profile.by_sender, strings.ends_with, strings.ilevenshtein, strings.ilike, strings.replace_confusables. Reference lists: $high_trust_sender_root_domains, $org_domains.
Indicators matched (21)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *mailchimp* |
strings.ilevenshtein | fuzzy | mailchimp |
ml.logo_detect(file.message_screenshot()).brands[].name | equals | MailChimp |
ml.logo_detect(file.message_screenshot()).brands[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Security and Authentication |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Secure Message |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Reminders and Notifications |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | member | medium |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | member | high |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].name | member | Security and Authentication |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].name | member | Secure Message |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].name | member | Reminders and Notifications |
9 more
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].confidence | member | medium |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics[].confidence | member | high |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents[].name | equals | cred_theft |
ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents[].confidence | equals | high |
sender.email.domain.root_domain | member | intuit.com |
sender.email.domain.root_domain | member | mailchimp.com |
strings.ends_with | suffix | .mailchimp.com> |