Detection rules › Sublime MQL
Brand impersonation: Stripe notification
Campaigns have been observed sending templated Stripe notification emails with the call-to-action button link replaced, clicking through to a malicious credential phishing page.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
strings.ilike(sender.display_name, 'stripe*')
or strings.ilevenshtein(sender.display_name, 'stripe') <= 1
or strings.ilike(sender.email.domain.domain, '*stripe*')
)
and (
any(body.links,
(
.display_text in~ ("view in dashboard")
or (
network.whois(.href_url.domain).days_old < 30
and regex.icontains(.display_text, 'view|click|dashboard|portal')
)
)
and .href_url.domain.root_domain != "stripe.com"
)
// if it's a well done fake payment notification, the only 2 links that aren't from Stripe
// are the customer's email address and the CTA button (view in dashboard, click for more info, etc.)
or (
length(filter(body.links,
.href_url.domain.root_domain != 'stripe.com'
and .display_text is not null
)
) == 2
and length(body.links) > 2
)
)
and not (
sender.email.domain.root_domain in ("stripe.com", "pinstripes.com")
and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
(
profile.by_sender().prevalence in ("new", "outlier")
and not profile.by_sender().solicited
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Campaigns have been observed sending templated Stripe notification emails with the call-to-action button link replaced, clicking through to a malicious credential phishing page.
- inbound message
any of:
- sender.display_name matches 'stripe*'
- sender.display_name is similar to 'stripe'
- sender.email.domain.domain matches '*stripe*'
any of:
any of
body.linkswhere all hold:any of:
- .display_text in ('view in dashboard')
all of:
- network.whois(.href_url.domain).days_old < 30
- .display_text matches 'view|click|dashboard|portal'
- .href_url.domain.root_domain is not 'stripe.com'
all of:
- length(filter(body.links, .href_url.domain.root_domain != 'stripe.com' and .display_text is not null)) is 2
- length(body.links) > 2
not:
all of:
- sender.email.domain.root_domain in ('stripe.com', 'pinstripes.com')
- headers.auth_summary.dmarc.pass
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of:
all of:
- profile.by_sender().prevalence in ('new', 'outlier')
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].display_text, body.links[].href_url.domain, body.links[].href_url.domain.root_domain, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: network.whois, profile.by_sender, regex.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $high_trust_sender_root_domains.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | stripe* |
strings.ilevenshtein | fuzzy | stripe |
strings.ilike | substring | *stripe* |
body.links[].display_text | member | view in dashboard |
regex.icontains | regex | view|click|dashboard|portal |
sender.email.domain.root_domain | member | stripe.com |
sender.email.domain.root_domain | member | pinstripes.com |