detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Robert Half

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating Robert Half, a staffing and recruiting company, by analyzing sender display names, logo detection in message screenshots, and specific company address references in the message body. The rule flags messages from senders not authenticated from legitimate Robert Half domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
body.current_thread
headers (collection)
headers.auth_summary
sender
sender.email
type

Rule body MQL

type.inbound
and (
  strings.icontains(sender.display_name, "Robert Half")
  or (
    any(ml.logo_detect(file.message_screenshot()).brands,
        .name == "Robert Half"
    )
    and strings.icontains(sender.display_name, "Robert Half")
  )
  or 2 of (
    strings.icontains(body.current_thread.text, 'Robert Half'),
    strings.icontains(body.current_thread.text, '2884 Sand Hill Road'),
    strings.icontains(body.current_thread.text, 'Menlo Park, CA 94025')
  )
)
// not a forward or reply
and (headers.in_reply_to is null or length(headers.references) == 0)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Newsletters and Digests",
              "Voicemail Call and Missed Call Notifications",
              "Advertising and Promotions"
            )
            and .confidence != "low"
)
// and the sender is not in org_domains or from Robert Half domains and passes auth
and not (
  sender.email.domain.root_domain in $org_domains
  or (
    sender.email.domain.root_domain in (
      "roberthalf.com",
      "roberthalf.be",
      "service-now.com",
      "protiviti.com",
      "atlassian.net",
      "workday.com",
      "myworkday.com"
    )
    and headers.auth_summary.dmarc.pass
  )
)

Detection logic

Scope: inbound message.

Detects messages impersonating Robert Half, a staffing and recruiting company, by analyzing sender display names, logo detection in message screenshots, and specific company address references in the message body. The rule flags messages from senders not authenticated from legitimate Robert Half domains.

  1. inbound message
  2. any of:
    • sender.display_name contains 'Robert Half'
    • all of:
      • any of ml.logo_detect(file.message_screenshot()).brands where:
        • .name is 'Robert Half'
      • sender.display_name contains 'Robert Half'
    • at least 2 of:
      • body.current_thread.text contains 'Robert Half'
      • body.current_thread.text contains '2884 Sand Hill Road'
      • body.current_thread.text contains 'Menlo Park, CA 94025'
  3. any of:
    • headers.in_reply_to is missing
    • length(headers.references) is 0
  4. not:
    • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
      • .name in ('Newsletters and Digests', 'Voicemail Call and Missed Call Notifications', 'Advertising and Promotions')
      • .confidence is not 'low'
  5. none of:
    • sender.email.domain.root_domain in $org_domains
    • all of:
      • sender.email.domain.root_domain in ('roberthalf.com', 'roberthalf.be', 'service-now.com', 'protiviti.com', 'atlassian.net', 'workday.com', 'myworkday.com')
      • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, ml.nlu_classifier, strings.icontains. Reference lists: $org_domains.

Indicators matched (14)

FieldMatchValue
strings.icontainssubstringRobert Half
ml.logo_detect(file.message_screenshot()).brands[].nameequalsRobert Half
strings.icontainssubstring2884 Sand Hill Road
strings.icontainssubstringMenlo Park, CA 94025
ml.nlu_classifier(body.current_thread.text).topics[].namememberNewsletters and Digests
ml.nlu_classifier(body.current_thread.text).topics[].namememberVoicemail Call and Missed Call Notifications
ml.nlu_classifier(body.current_thread.text).topics[].namememberAdvertising and Promotions
sender.email.domain.root_domainmemberroberthalf.com
sender.email.domain.root_domainmemberroberthalf.be
sender.email.domain.root_domainmemberservice-now.com
sender.email.domain.root_domainmemberprotiviti.com
sender.email.domain.root_domainmemberatlassian.net
2 more
sender.email.domain.root_domainmemberworkday.com
sender.email.domain.root_domainmembermyworkday.com