Detection rules › Sublime MQL
Impersonation: Fake product discount promotion
Detects messages containing fake product discount offers that leads to a googleapis.com domain.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering, Free file host |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and strings.icontains(body.current_thread.text,
"hi {email}",
"participation is voluntary",
"limit one discount",
"limited time offer",
"code",
"survey"
)
and (
regex.icontains(body.current_thread.text, 'claim \d+% off')
or regex.icontains(body.current_thread.text, '\d+ question')
)
and any(body.current_thread.links,
.href_url.domain.root_domain == "googleapis.com"
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Advertising and Promotions")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages containing fake product discount offers that leads to a googleapis.com domain.
- inbound message
body.current_thread.text contains any of 6 patterns
hi {email}participation is voluntarylimit one discountlimited time offercodesurvey
any of:
- body.current_thread.text matches 'claim \\d+% off'
- body.current_thread.text matches '\\d+ question'
any of
body.current_thread.linkswhere:- .href_url.domain.root_domain is 'googleapis.com'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Advertising and Promotions')
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | hi {email} |
strings.icontains | substring | participation is voluntary |
strings.icontains | substring | limit one discount |
strings.icontains | substring | limited time offer |
strings.icontains | substring | code |
strings.icontains | substring | survey |
regex.icontains | regex | claim \d+% off |
regex.icontains | regex | \d+ question |
body.current_thread.links[].href_url.domain.root_domain | equals | googleapis.com |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Advertising and Promotions |