Brand impersonation: Morgan Stanley

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages impersonating Morgan Stanley that contain indicators of credential theft or callback scams, including references to secure email systems, client service centers, financial advisors, and registration processes. The rule identifies spoofed communications by checking for Morgan Stanley branding elements while excluding legitimate domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Impersonation: Brand, Social engineering

Event coverage

Message attribute
body.current_thread
headers (collection)
headers.auth_summary
headers.domains (collection)
headers.hops (collection)
sender
sender.email
type

Rule body MQL

type.inbound
and (
  strings.ilike(strings.replace_confusables(sender.display_name),
                '*morgan stanley*',
                '*morganstanley*'
  )
  or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                          'morgan stanley'
  ) <= 2
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name in ("org", "sender")
         and strings.icontains(.text, 'Morgan Stanley')
  )
  or strings.icontains(body.current_thread.text,
                       'secure.emailhelp@morganstanley.com'
  )
)
and strings.icontains(body.current_thread.text, "Morgan Stanley")
and 3 of (
  strings.icontains(body.current_thread.text, "Client Service Center"),
  regex.icontains(body.current_thread.text,
                  'Financial Advis?or\s*[|/]\s*(?:Portfolio\s+)?Manager'
  ),
  regex.icontains(body.current_thread.text, 'Secure (?:E-)?Mail'),
  strings.icontains(body.current_thread.text, "Click here to view"),
  strings.icontains(body.current_thread.text, "encrypted messages"),
  strings.icontains(body.current_thread.text, "1-800-780-0256"),
  strings.icontains(body.current_thread.text,
                    "secure.emailhelp@morganstanley.com"
  ),
  regex.icontains(body.current_thread.text,
                  'Morgan Stanley\s+(?:Smith Barney|Wealth Management|\w+\s+Team)'
  ),
  strings.icontains(body.current_thread.text, "one-time registration"),
  strings.icontains(body.current_thread.text, "see payment activity"),
  regex.icontains(body.current_thread.text,
                  'link will expire on \d{4}-\d{2}-\d{2}'
  ),
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("cred_theft", "callback_scam") and .confidence == "high"
  )
)
and not (
  sender.email.domain.root_domain in ("docusign.net", "morganstanley.com", )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  any(headers.hops,
      any(.fields,
          .name == "X-ProofpointSecure"
          and strings.icontains(.value, "Encrypted")
      )
  )
  and any(headers.domains, .root_domain == "pphosted.com")
)

Detection logic

Scope: inbound message.

inbound message
any of:
- strings.replace_confusables(sender.display_name) matches any of 2 patterns
  - *morgan stanley*
  - *morganstanley*
- strings.replace_confusables(sender.display_name) is similar to 'morgan stanley'
- any of ml.nlu_classifier(body.current_thread.text).entities where all hold:
  - .name in ('org', 'sender')
  - .text contains 'Morgan Stanley'
- body.current_thread.text contains 'secure.emailhelp@morganstanley.com'
body.current_thread.text contains 'Morgan Stanley'
at least 3 of:
- body.current_thread.text contains 'Client Service Center'
- body.current_thread.text matches 'Financial Advis?or\\s*[|/]\\s*(?:Portfolio\\s+)?Manager'
- body.current_thread.text matches 'Secure (?:E-)?Mail'
- body.current_thread.text contains 'Click here to view'
- body.current_thread.text contains 'encrypted messages'
- body.current_thread.text contains '1-800-780-0256'
- body.current_thread.text contains 'secure.emailhelp@morganstanley.com'
- body.current_thread.text matches 'Morgan Stanley\\s+(?:Smith Barney|Wealth Management|\\w+\\s+Team)'
- body.current_thread.text contains 'one-time registration'
- body.current_thread.text contains 'see payment activity'
- body.current_thread.text matches 'link will expire on \\d{4}-\\d{2}-\\d{2}'
- any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
  - .name in ('cred_theft', 'callback_scam')
  - .confidence is 'high'
not:
- all of:
  - sender.email.domain.root_domain in ('docusign.net', 'morganstanley.com')
  - coalesce(headers.auth_summary.dmarc.pass)
not:
- all of:
  - any of headers.hops where:
    
    any of .fields where all hold:
    
    .name is 'X-ProofpointSecure'
    .value contains 'Encrypted'
  - any of headers.domains where:
    
    .root_domain is 'pphosted.com'

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.domains, headers.domains[].root_domain, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike, strings.replace_confusables.

Indicators matched (25)

Field	Match	Value
`strings.ilike`	substring	`morgan stanley`
`strings.ilike`	substring	`morganstanley`
`strings.ilevenshtein`	fuzzy	`morgan stanley`
`ml.nlu_classifier(body.current_thread.text).entities[].name`	member	`org`
`ml.nlu_classifier(body.current_thread.text).entities[].name`	member	`sender`
`strings.icontains`	substring	`Morgan Stanley`
`strings.icontains`	substring	`secure.emailhelp@morganstanley.com`
`strings.icontains`	substring	`Client Service Center`
`regex.icontains`	regex	`Financial Advis?or\s[\|/]\s(?:Portfolio\s+)?Manager`
`regex.icontains`	regex	`Secure (?:E-)?Mail`
`strings.icontains`	substring	`Click here to view`
`strings.icontains`	substring	`encrypted messages`

13 more

`strings.icontains`	substring	`1-800-780-0256`
`regex.icontains`	regex	`Morgan Stanley\s+(?:Smith Barney\|Wealth Management\|\w+\s+Team)`
`strings.icontains`	substring	`one-time registration`
`strings.icontains`	substring	`see payment activity`
`regex.icontains`	regex	`link will expire on \d{4}-\d{2}-\d{2}`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`cred_theft`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	member	`callback_scam`
`ml.nlu_classifier(body.current_thread.text).intents[].confidence`	equals	`high`
`sender.email.domain.root_domain`	member	`docusign.net`
`sender.email.domain.root_domain`	member	`morganstanley.com`
`headers.hops[].fields[].name`	equals	`X-ProofpointSecure`
`strings.icontains`	substring	`Encrypted`
`headers.domains[].root_domain`	equals	`pphosted.com`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)