Detection rules › Sublime MQL
Sendgrid voicemail phish
The message may contain a fake voicemail notification being sent via Sendgrid.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.return_path |
| subject |
| type |
Rule body MQL
type.inbound
and headers.return_path.domain.domain == 'sendgrid.net'
and (
regex.icontains(strings.replace_confusables(subject.subject),
'v[o0][il1]cema[il1][li1]',
'v[o0][il1]ce message'
)
or any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Voicemail Call and Missed Call Notifications"
and .confidence == "high"
)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name not in ("benign")
)
Detection logic
Scope: inbound message.
The message may contain a fake voicemail notification being sent via Sendgrid.
- inbound message
- headers.return_path.domain.domain is 'sendgrid.net'
any of:
strings.replace_confusables(subject.subject) matches any of 2 patterns
v[o0][il1]cema[il1][li1]v[o0][il1]ce message
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Voicemail Call and Missed Call Notifications'
- .confidence is 'high'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name not in ('benign')
Inspects: body.current_thread.text, headers.return_path.domain.domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.replace_confusables.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
headers.return_path.domain.domain | equals | sendgrid.net |
regex.icontains | regex | v[o0][il1]cema[il1][li1] |
regex.icontains | regex | v[o0][il1]ce message |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Voicemail Call and Missed Call Notifications |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | benign |