Detection rules › Sublime MQL
Brand impersonation: Marriott with gift language
Detects messages impersonating Marriott brand that contain gift-related language such as 'appreciation gift', 'thank you gift', or 'something special' from senders not associated with legitimate Marriott domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and (
strings.icontains(subject.base, "marriott")
or strings.icontains(sender.display_name, "marriott")
or strings.ilevenshtein(sender.display_name, 'marriott') <= 2
)
and any([body.current_thread.text, subject.base],
regex.icontains(.,
'(?:appreciation|thank)(?:\s|-)?(you)?\s+gift',
'something special',
'special.{0,10}thank(?:\s|-)you'
)
)
and not (
sender.email.domain.root_domain in~ (
"marriott.com",
"res-marriott.com",
"email-marriott.com",
"feedback-marriott.com",
"marriotthotels.se",
"bookonline.com"
)
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages impersonating Marriott brand that contain gift-related language such as 'appreciation gift', 'thank you gift', or 'something special' from senders not associated with legitimate Marriott domains.
- inbound message
any of:
- subject.base contains 'marriott'
- sender.display_name contains 'marriott'
- sender.display_name is similar to 'marriott'
any of
[body.current_thread.text, subject.base]where:. matches any of 3 patterns
(?:appreciation|thank)(?:\s|-)?(you)?\s+giftsomething specialspecial.{0,10}thank(?:\s|-)you
not:
all of:
- sender.email.domain.root_domain in ('marriott.com', 'res-marriott.com', 'email-marriott.com', 'feedback-marriott.com', 'marriotthotels.se', 'bookonline.com')
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: regex.icontains, strings.icontains, strings.ilevenshtein.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | marriott |
strings.ilevenshtein | fuzzy | marriott |
regex.icontains | regex | (?:appreciation|thank)(?:\s|-)?(you)?\s+gift |
regex.icontains | regex | something special |
regex.icontains | regex | special.{0,10}thank(?:\s|-)you |
sender.email.domain.root_domain | member | marriott.com |
sender.email.domain.root_domain | member | res-marriott.com |
sender.email.domain.root_domain | member | email-marriott.com |
sender.email.domain.root_domain | member | feedback-marriott.com |
sender.email.domain.root_domain | member | marriotthotels.se |
sender.email.domain.root_domain | member | bookonline.com |