Detection rules › Sublime MQL
Brand impersonation: Squarespace
Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
strings.icontains(sender.display_name, "squarespace")
or strings.ilevenshtein(sender.display_name, "squarespace") < 2
)
// and the sender is not in org_domains or from Squarespace domains and passes auth
and not (
sender.email.domain.root_domain in $org_domains
or (
sender.email.domain.root_domain in (
"squarespace.com",
"squarespace.info",
"shipstation.com"
)
and headers.auth_summary.dmarc.pass
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks.
- inbound message
any of:
- sender.display_name contains 'squarespace'
- sender.display_name is similar to 'squarespace'
none of:
- sender.email.domain.root_domain in $org_domains
all of:
- sender.email.domain.root_domain in ('squarespace.com', 'squarespace.info', 'shipstation.com')
- headers.auth_summary.dmarc.pass
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: strings.icontains, strings.ilevenshtein. Reference lists: $high_trust_sender_root_domains, $org_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | squarespace |
strings.ilevenshtein | fuzzy | squarespace |
sender.email.domain.root_domain | member | squarespace.com |
sender.email.domain.root_domain | member | squarespace.info |
sender.email.domain.root_domain | member | shipstation.com |