Detection rules › Sublime MQL
Credential phishing: Tax form impersonation with payment request
Detects messages impersonating tax-related communications that contain payment requests and PDF links, excluding legitimate tax service providers. The rule identifies tax terminology combined with payment solicitation language and PDF link references, which is a common pattern in tax season scams.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering, PDF |
Event coverage
Rule body MQL
type.inbound
and any([body.current_thread.text, subject.subject],
regex.icontains(.,
'schedule.c\b',
'tax.form',
'1099\b',
'\bw-?2\b',
'tax.return',
'tax.preparation'
)
and (
regex.icontains(body.current_thread.text,
"reply.with.your.payment",
"payment.details",
"send.payment.information",
"provide.payment",
"payment.method",
"billing.information",
"processing.fee",
"completion.fee"
)
)
and any(body.links, strings.icontains(.display_text, "PDF"))
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Events and Webinars", "Newsletters and Digests")
)
and not sender.email.domain.root_domain in (
"intuit.com",
"hrblock.com",
"turbotax.com",
"taxact.com",
"freetaxusa.com",
"geico.com",
"eventshq.com",
"square.com"
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects messages impersonating tax-related communications that contain payment requests and PDF links, excluding legitimate tax service providers. The rule identifies tax terminology combined with payment solicitation language and PDF link references, which is a common pattern in tax season scams.
- inbound message
any of
[body.current_thread.text, subject.subject]where all hold:. matches any of 6 patterns
schedule.c\btax.form1099\b\bw-?2\btax.returntax.preparation
body.current_thread.text matches any of 8 patterns
reply.with.your.paymentpayment.detailssend.payment.informationprovide.paymentpayment.methodbilling.informationprocessing.feecompletion.fee
any of
body.linkswhere:- .display_text contains 'PDF'
not:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Events and Webinars', 'Newsletters and Digests')
not:
- sender.email.domain.root_domain in ('intuit.com', 'hrblock.com', 'turbotax.com', 'taxact.com', 'freetaxusa.com', 'geico.com', 'eventshq.com', 'square.com')
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, body.links, body.links[].display_text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (25)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | schedule.c\b |
regex.icontains | regex | tax.form |
regex.icontains | regex | 1099\b |
regex.icontains | regex | \bw-?2\b |
regex.icontains | regex | tax.return |
regex.icontains | regex | tax.preparation |
regex.icontains | regex | reply.with.your.payment |
regex.icontains | regex | payment.details |
regex.icontains | regex | send.payment.information |
regex.icontains | regex | provide.payment |
regex.icontains | regex | payment.method |
regex.icontains | regex | billing.information |
13 more
regex.icontains | regex | processing.fee |
regex.icontains | regex | completion.fee |
strings.icontains | substring | PDF |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Events and Webinars |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Newsletters and Digests |
sender.email.domain.root_domain | member | intuit.com |
sender.email.domain.root_domain | member | hrblock.com |
sender.email.domain.root_domain | member | turbotax.com |
sender.email.domain.root_domain | member | taxact.com |
sender.email.domain.root_domain | member | freetaxusa.com |
sender.email.domain.root_domain | member | geico.com |
sender.email.domain.root_domain | member | eventshq.com |
sender.email.domain.root_domain | member | square.com |