Detection rules › Sublime MQL

Fake warning banner using confusable characters

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing fake security banners that use visually similar characters to impersonate legitimate sender verification text, potentially to bypass security controls and deceive recipients.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and (
  regex.contains(strings.replace_confusables(body.current_thread.text),
                 'This sender has been verified fro(?:m|rn) safe senders list'
  )
  or any(body.current_thread.banners,
         regex.contains(strings.replace_confusables(.text),
                        'This sender has been verified fro(?:m|rn) safe senders list'
         )
  )
)

Detection logic

Scope: inbound message.

Detects messages containing fake security banners that use visually similar characters to impersonate legitimate sender verification text, potentially to bypass security controls and deceive recipients.

  1. inbound message
  2. any of:
    • strings.replace_confusables(body.current_thread.text) matches 'This sender has been verified fro(?:m|rn) safe senders list'
    • any of body.current_thread.banners where:
      • strings.replace_confusables(.text) matches 'This sender has been verified fro(?:m|rn) safe senders list'

Inspects: body.current_thread.banners, body.current_thread.banners[].text, body.current_thread.text, type.inbound. Sensors: regex.contains, strings.replace_confusables.

Indicators matched (1)

FieldMatchValue
regex.containsregexThis sender has been verified fro(?:m|rn) safe senders list