detection.wiki

Detection rules › Sublime MQL

Canva infrastructure abuse

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

A fraudulent invoice/receipt found in the body of the message sent by exploiting Canva's design sharing feature.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Callback Phishing
Tactics and techniquesSocial engineering, Impersonation: Brand, Impersonation: Employee, Free email provider

Event coverage

Message attribute
body.current_thread
body.html
sender.email
type

Rule body MQL

type.inbound
and length(attachments) <= 1
and sender.email.domain.root_domain in ("canva.com")
and (
  strings.ilike(body.html.display_text, "*take a look at the design*")
  or regex.icontains(body.current_thread.text, 'invited.{0,10}(?:class|school)')
  or strings.icontains(body.current_thread.text, "no longer have access")
)
and (
  (
    // icontains a phone number
    (
      regex.icontains(strings.replace_confusables(body.current_thread.text),
                      '.*\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\n'
      )
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\+[ilo0-9]{1,3}[ilo0-9]{10}.*\n'
      )
      // +12028001238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.*\n'
      )
      // 202-800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
      )
      // (202) 800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.*\n'
      )
      // (202)-800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\([ilo0-9]{3}\)-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
      )
      or ( // 8123456789
        regex.icontains(strings.replace_confusables(body.current_thread.text),
                        '.*8[ilo0-9]{9}.*\n'
        )
        and regex.icontains(strings.replace_confusables(body.current_thread.text
                            ),
                            '\+[1l]'
        )
      )
    )
    and (
      (
        4 of (
          strings.ilike(body.html.inner_text, '*you did not*'),
          strings.ilike(body.html.inner_text, '*is not for*'),
          strings.ilike(body.html.inner_text, '*done by you*'),
          regex.icontains(body.html.inner_text, "didn\'t ma[kd]e this"),
          strings.ilike(body.html.inner_text, '*Fruad Alert*'),
          strings.ilike(body.html.inner_text, '*Fraud Alert*'),
          strings.ilike(body.html.inner_text, '*fraudulent*'),
          strings.ilike(body.html.inner_text, '*using your PayPal*'),
          strings.ilike(body.html.inner_text, '*subscription*'),
          strings.ilike(body.html.inner_text, '*antivirus*'),
          strings.ilike(body.html.inner_text, '*order*'),
          strings.ilike(body.html.inner_text, '*support*'),
          strings.ilike(body.html.inner_text, '*sincerely apologize*'),
          strings.ilike(body.html.inner_text, '*receipt*'),
          strings.ilike(body.html.inner_text, '*invoice*'),
          strings.ilike(body.html.inner_text, '*Purchase*'),
          strings.ilike(body.html.inner_text, '*transaction*'),
          strings.ilike(body.html.inner_text, '*Market*Value*'),
          strings.ilike(body.html.inner_text, '*BTC*'),
          strings.ilike(body.html.inner_text, '*call*'),
          strings.ilike(body.html.inner_text, '*get in touch with our*'),
          strings.ilike(body.html.inner_text, '*quickly inform*'),
          strings.ilike(body.html.inner_text, '*quickly reach *'),
          strings.ilike(body.html.inner_text, '*detected unusual transactions*'),
          strings.ilike(body.html.inner_text, '*without your authorization*'),
          strings.ilike(body.html.inner_text, '*cancel*'),
          strings.ilike(body.html.inner_text, '*renew*'),
          strings.ilike(body.html.inner_text, '*refund*'),
          strings.ilike(body.html.inner_text, '*+1*'),
          regex.icontains(body.html.inner_text, 'help.{0,3}desk'),
          strings.ilike(body.html.inner_text, '* your funds*'),
          strings.ilike(body.html.inner_text, '* your checking*'),
          strings.ilike(body.html.inner_text, '* your saving*'),
          strings.ilike(body.html.inner_text, '*transfer*'),
          strings.ilike(body.html.inner_text, '*secure your account*'),
          strings.ilike(body.html.inner_text, '*recover your*'),
          strings.ilike(body.html.inner_text, '*unusual activity*'),
          strings.ilike(body.html.inner_text, '*suspicious transaction*'),
          strings.ilike(body.html.inner_text, '*transaction history*'),
          strings.ilike(body.html.inner_text, '*please ignore this*'),
          strings.ilike(body.html.inner_text, '*report activity*'),
        )
      )
      or regex.icontains(body.current_thread.text,
                         'note from.{0,50}(?:call|reach|contact|paypal)'
      )
      or any(ml.nlu_classifier(body.current_thread.text).intents,
             .name == "callback_scam"
      )
      or (
        // Unicode confusables words obfuscated in note
        regex.icontains(body.html.inner_text,
                        '\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹'
        )
      )
      or strings.ilike(body.html.inner_text, '*kindly*')
    )
  )
)

Detection logic

Scope: inbound message.

A fraudulent invoice/receipt found in the body of the message sent by exploiting Canva's design sharing feature.

  1. inbound message
  2. length(attachments) ≤ 1
  3. sender.email.domain.root_domain in ('canva.com')
  4. any of:
    • body.html.display_text matches '*take a look at the design*'
    • body.current_thread.text matches 'invited.{0,10}(?:class|school)'
    • body.current_thread.text contains 'no longer have access'
  5. all of:
    • any of:
      • strings.replace_confusables(body.current_thread.text) matches '.*\\+?([ilo0-9]{1}.)?\\(?[ilo0-9]{3}?\\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\\n'
      • strings.replace_confusables(body.current_thread.text) matches '.*\\+[ilo0-9]{1,3}[ilo0-9]{10}.*\\n'
      • strings.replace_confusables(body.current_thread.text) matches '.*[ilo0-9]{3}\\.[ilo0-9]{3}\\.[ilo0-9]{4}.*\\n'
      • strings.replace_confusables(body.current_thread.text) matches '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\\n'
      • strings.replace_confusables(body.current_thread.text) matches '.*\\([ilo0-9]{3}\\)[\\s-]+[ilo0-9]{3}[\\s-]+[ilo0-9]{4}.*\\n'
      • strings.replace_confusables(body.current_thread.text) matches '.*\\([ilo0-9]{3}\\)-[ilo0-9]{3}-[ilo0-9]{4}.*\\n'
      • all of:
        • strings.replace_confusables(body.current_thread.text) matches '.*8[ilo0-9]{9}.*\\n'
        • strings.replace_confusables(body.current_thread.text) matches '\\+[1l]'
    • any of:
      • at least 4 of 41: body.html.inner_text matches any of 41 patterns
        • *you did not*
        • *is not for*
        • *done by you*
        • didn\'t ma[kd]e this
        • *Fruad Alert*
        • *Fraud Alert*
        • *fraudulent*
        • *using your PayPal*
        • *subscription*
        • *antivirus*
        • *order*
        • *support*
        • *sincerely apologize*
        • *receipt*
        • *invoice*
        • *Purchase*
        • *transaction*
        • *Market*Value*
        • *BTC*
        • *call*
        • *get in touch with our*
        • *quickly inform*
        • *quickly reach *
        • *detected unusual transactions*
        • *without your authorization*
        • *cancel*
        • *renew*
        • *refund*
        • *+1*
        • help.{0,3}desk
        • * your funds*
        • * your checking*
        • * your saving*
        • *transfer*
        • *secure your account*
        • *recover your*
        • *unusual activity*
        • *suspicious transaction*
        • *transaction history*
        • *please ignore this*
        • *report activity*
      • body.current_thread.text matches 'note from.{0,50}(?:call|reach|contact|paypal)'
      • any of ml.nlu_classifier(body.current_thread.text).intents where:
        • .name is 'callback_scam'
      • body.html.inner_text matches '\\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹'
      • body.html.inner_text matches '*kindly*'

Inspects: body.current_thread.text, body.html.display_text, body.html.inner_text, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilike, strings.replace_confusables.

Indicators matched (57)

FieldMatchValue
sender.email.domain.root_domainmembercanva.com
strings.ilikesubstring*take a look at the design*
regex.icontainsregexinvited.{0,10}(?:class|school)
strings.icontainssubstringno longer have access
regex.icontainsregex.*\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\n
regex.icontainsregex.*\+[ilo0-9]{1,3}[ilo0-9]{10}.*\n
regex.icontainsregex.*[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.*\n
regex.icontainsregex.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\n
regex.icontainsregex.*\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.*\n
regex.icontainsregex.*\([ilo0-9]{3}\)-[ilo0-9]{3}-[ilo0-9]{4}.*\n
regex.icontainsregex.*8[ilo0-9]{9}.*\n
regex.icontainsregex\+[1l]
45 more
strings.ilikesubstring*you did not*
strings.ilikesubstring*is not for*
strings.ilikesubstring*done by you*
regex.icontainsregexdidn\'t ma[kd]e this
strings.ilikesubstring*Fruad Alert*
strings.ilikesubstring*Fraud Alert*
strings.ilikesubstring*fraudulent*
strings.ilikesubstring*using your PayPal*
strings.ilikesubstring*subscription*
strings.ilikesubstring*antivirus*
strings.ilikesubstring*order*
strings.ilikesubstring*support*
strings.ilikesubstring*sincerely apologize*
strings.ilikesubstring*receipt*
strings.ilikesubstring*invoice*
strings.ilikesubstring*Purchase*
strings.ilikesubstring*transaction*
strings.ilikesubstring*Market*Value*
strings.ilikesubstring*BTC*
strings.ilikesubstring*call*
strings.ilikesubstring*get in touch with our*
strings.ilikesubstring*quickly inform*
strings.ilikesubstring*quickly reach *
strings.ilikesubstring*detected unusual transactions*
strings.ilikesubstring*without your authorization*
strings.ilikesubstring*cancel*
strings.ilikesubstring*renew*
strings.ilikesubstring*refund*
strings.ilikesubstring*+1*
regex.icontainsregexhelp.{0,3}desk
strings.ilikesubstring* your funds*
strings.ilikesubstring* your checking*
strings.ilikesubstring* your saving*
strings.ilikesubstring*transfer*
strings.ilikesubstring*secure your account*
strings.ilikesubstring*recover your*
strings.ilikesubstring*unusual activity*
strings.ilikesubstring*suspicious transaction*
strings.ilikesubstring*transaction history*
strings.ilikesubstring*please ignore this*
strings.ilikesubstring*report activity*
regex.icontainsregexnote from.{0,50}(?:call|reach|contact|paypal)
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscallback_scam
regex.icontainsregex\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹
strings.ilikesubstring*kindly*