Detection rules › Sublime MQL
Brand impersonation: Canada Revenue Agency
Detects messages impersonating the Canada Revenue Agency (CRA) in English or French that contain credential theft indicators. The rule identifies senders claiming to be CRA through display names or subject line references, uses natural language understanding to detect credential theft intent, and excludes legitimate senders with proper authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
// sender claims to be CRA
and (
strings.icontains(sender.display_name, 'canada revenue agency')
or strings.icontains(sender.display_name, 'agence du revenu du canada')
or (
// cra display name and cra reference in subject
regex.icontains(sender.display_name, '\bcra\b')
and regex.icontains(subject.base,
'(?:T4|cra|tax|canada revenue|revenu du canada)'
)
)
)
// nlu cred theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != 'low'
)
and not (
(
// negate highly trusted sender domains
sender.email.domain.root_domain in $high_trust_sender_root_domains
// negate legit senders from merck
or sender.email.domain.root_domain == "cra-arc.gc.ca"
)
// enforce auth
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages impersonating the Canada Revenue Agency (CRA) in English or French that contain credential theft indicators. The rule identifies senders claiming to be CRA through display names or subject line references, uses natural language understanding to detect credential theft intent, and excludes legitimate senders with proper authentication.
- inbound message
any of:
- sender.display_name contains 'canada revenue agency'
- sender.display_name contains 'agence du revenu du canada'
all of:
- sender.display_name matches '\\bcra\\b'
- subject.base matches '(?:T4|cra|tax|canada revenue|revenu du canada)'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
not:
all of:
any of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- sender.email.domain.root_domain is 'cra-arc.gc.ca'
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | canada revenue agency |
strings.icontains | substring | agence du revenu du canada |
regex.icontains | regex | \bcra\b |
regex.icontains | regex | (?:T4|cra|tax|canada revenue|revenu du canada) |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
sender.email.domain.root_domain | equals | cra-arc.gc.ca |