Detection rules › Sublime MQL

Sendgrid voicemail phish

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

The message may contain a fake voicemail notification being sent via Sendgrid.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering

Event coverage

Rule body MQL

type.inbound
and headers.return_path.domain.domain == 'sendgrid.net'
and (
  regex.icontains(strings.replace_confusables(subject.subject),
                  'v[o0][il1]cema[il1][li1]',
                  'v[o0][il1]ce message'
  )
  or any(ml.nlu_classifier(body.current_thread.text).topics,
         .name == "Voicemail Call and Missed Call Notifications"
         and .confidence == "high"
  )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name not in ("benign")
)

Detection logic

Scope: inbound message.

The message may contain a fake voicemail notification being sent via Sendgrid.

  1. inbound message
  2. headers.return_path.domain.domain is 'sendgrid.net'
  3. any of:
    • strings.replace_confusables(subject.subject) matches any of 2 patterns
      • v[o0][il1]cema[il1][li1]
      • v[o0][il1]ce message
    • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
      • .name is 'Voicemail Call and Missed Call Notifications'
      • .confidence is 'high'
  4. any of ml.nlu_classifier(body.current_thread.text).intents where:
    • .name not in ('benign')

Inspects: body.current_thread.text, headers.return_path.domain.domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.replace_confusables.

Indicators matched (6)

FieldMatchValue
headers.return_path.domain.domainequalssendgrid.net
regex.icontainsregexv[o0][il1]cema[il1][li1]
regex.icontainsregexv[o0][il1]ce message
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsVoicemail Call and Missed Call Notifications
ml.nlu_classifier(body.current_thread.text).topics[].confidenceequalshigh
ml.nlu_classifier(body.current_thread.text).intents[].namememberbenign