Detection rules › Sublime MQL
Brand impersonation: WeTransfer
Detects messages claiming to be from WeTransfer that contain suspicious indicators, including misspelled domains, non-standard TLDs, suspicious file reference numbers, and French language variations. Excludes legitimate WeTransfer traffic with valid DMARC authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Callback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam |
| Tactics and techniques | Impersonation: Brand |
Event coverage
Rule body MQL
type.inbound
and 2 of (
(
strings.ilike(sender.display_name, '*wetransfer*')
or strings.ilike(sender.display_name, '*we transfer*')
or strings.ilevenshtein(sender.display_name, "wetransfer") <= 1
),
// Check for misspelled wetransfer domains in sender email
regex.icontains(sender.email.email, 'nore?pl[a@]y@wetransfer'),
// Check for non-legitimate TLDs (.fr or others)
regex.icontains(sender.email.domain.root_domain, 'wetransfer\\.[a-z]{2,4}$'),
// Suspicious subject patterns
regex.icontains(subject.subject,
'(?:Documents?|Files?) (?:Received|Sent) (?:via)? WeTransfer'
),
// Check for file reference numbers which are common in phishing
regex.icontains(subject.subject,
'WeTransfer \[(?:File No\.|)\s*:\s*[0-9-]+\s*\]'
),
// French language patterns
regex.icontains(subject.subject, 'vous a envoy[ée] .{1,30} par WeTransfer'),
regex.icontains(subject.subject, "T[ÉE]L[ÉE]CHARGEZ VOTRE FICHIER"),
regex.icontains(body.current_thread.text, 'transfert expirera'),
regex.icontains(body.current_thread.text,
"fichiers n'aient pas encore été téléchargés"
),
any(body.links,
strings.ilike(.display_text, '*wetransfer*')
and .href_url.domain.root_domain not in~ ('wetransfer.com', 'we.tl')
),
any(body.links,
(
.href_url.domain.root_domain in $free_file_hosts
and .href_url.domain.root_domain not in~ ('wetransfer.com', 'we.tl')
)
or network.whois(.href_url.domain).days_old < 30
or .href_url.domain.tld in $suspicious_tlds
)
)
and not (
sender.email.domain.root_domain in ("wetransfer.com", "we.tl")
and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Detects messages claiming to be from WeTransfer that contain suspicious indicators, including misspelled domains, non-standard TLDs, suspicious file reference numbers, and French language variations. Excludes legitimate WeTransfer traffic with valid DMARC authentication.
- inbound message
at least 2 of:
any of:
- sender.display_name matches '*wetransfer*'
- sender.display_name matches '*we transfer*'
- sender.display_name is similar to 'wetransfer'
- sender.email.email matches 'nore?pl[a@]y@wetransfer'
- sender.email.domain.root_domain matches 'wetransfer\\\\.[a-z]{2,4}$'
- subject.subject matches '(?:Documents?|Files?) (?:Received|Sent) (?:via)? WeTransfer'
- subject.subject matches 'WeTransfer \\[(?:File No\\.|)\\s*:\\s*[0-9-]+\\s*\\]'
- subject.subject matches 'vous a envoy[ée] .{1,30} par WeTransfer'
- subject.subject matches 'T[ÉE]L[ÉE]CHARGEZ VOTRE FICHIER'
- body.current_thread.text matches 'transfert expirera'
- body.current_thread.text matches "fichiers n'aient pas encore été téléchargés"
any of
body.linkswhere all hold:- .display_text matches '*wetransfer*'
- .href_url.domain.root_domain not in ('wetransfer.com', 'we.tl')
any of
body.linkswhere any holds:all of:
- .href_url.domain.root_domain in $free_file_hosts
- .href_url.domain.root_domain not in ('wetransfer.com', 'we.tl')
- network.whois(.href_url.domain).days_old < 30
- .href_url.domain.tld in $suspicious_tlds
not:
all of:
- sender.email.domain.root_domain in ('wetransfer.com', 'we.tl')
- headers.auth_summary.dmarc.pass
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.tld, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, sender.email.email, subject.subject, type.inbound. Sensors: network.whois, profile.by_sender, regex.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $free_file_hosts, $high_trust_sender_root_domains, $suspicious_tlds.
Indicators matched (15)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *wetransfer* |
strings.ilike | substring | *we transfer* |
strings.ilevenshtein | fuzzy | wetransfer |
regex.icontains | regex | nore?pl[a@]y@wetransfer |
regex.icontains | regex | wetransfer\\.[a-z]{2,4}$ |
regex.icontains | regex | (?:Documents?|Files?) (?:Received|Sent) (?:via)? WeTransfer |
regex.icontains | regex | WeTransfer \[(?:File No\.|)\s*:\s*[0-9-]+\s*\] |
regex.icontains | regex | vous a envoy[ée] .{1,30} par WeTransfer |
regex.icontains | regex | T[ÉE]L[ÉE]CHARGEZ VOTRE FICHIER |
regex.icontains | regex | transfert expirera |
regex.icontains | regex | fichiers n'aient pas encore été téléchargés |
body.links[].href_url.domain.root_domain | member | wetransfer.com |
3 more
body.links[].href_url.domain.root_domain | member | we.tl |
sender.email.domain.root_domain | member | wetransfer.com |
sender.email.domain.root_domain | member | we.tl |