Sublime MQL rules: impersonation

type.inbound

// attacks have been observed where the impersonation is
// in the subject, and the display name contains what a
// subject typically would contain. this is an attempt to
// bypass impersonation detections
and subject.base in~ $org_display_names
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "bec" and .confidence in ("medium", "high")
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

type.inbound
and sender.email.domain.domain not in $org_domains
and (
  length(body.current_thread.text) < 5000 or body.current_thread.text is null
)
and (
  regex.icontains(subject.subject,
                  '(open|benefits?) enrol{1,2}ment', // catches both enrolment and enrollment
                  'benefit(s)?.{0,10}(?:plan|choice|selection|deadline|period|summary)',
                  'hr benefits',
                  'annual enrol{1,2}ment',
                  'healthcare (choice|selection|opt.?in)',
                  '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                  'dependent (coverage|verification)',
                  '(health|dental|vision|insurance|medical) enrol{1,2}ment'
  )
  or regex.icontains(body.current_thread.text,
                     'benefit(s)? (plan|choice|selection|deadline|period)',
                     'hr benefits',
                     'annual enrol{1,2}ment',
                     'healthcare (choice|selection|opt.?in)',
                     '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                     'dependent (coverage|verification)',
                     '(health|dental|vision|insurance|medical) enrol{1,2}ment',
                     '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
                     'coverage.{0,20}(expire|terminate)',
                     'last (day|chance).{0,20}(enrol{1,2}|select)',
                     '(login|sign.?in).{0,20}(benefit portal|hr portal)',
                     '(verify|update|confirm).{0,20}(benefit.{0,20}selection)'
  )
  or any(attachments,
         regex.icontains(.file_name,
                         'fileDoc-Review',
                         '(open|benefits?) enrol{1,2}ment',
                         'annual enrol{1,2}ment',
                         '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                         '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
         )
  )
)
and 2 of (
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name in ("urgency", "request")
  ),
  any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign"),
  (
    (length(body.current_thread.text) < 250 and length(attachments) == 1)
    or (body.current_thread.text is null and length(attachments) == 1)
  ),
  // lure in attachment
  (
    any(attachments,
        (
          .file_type in $file_types_images
          or .file_type in ("pdf", "docx", "doc")
          or .file_extension in $file_extensions_macros
        )
        and any(filter(file.explode(.), .scan.ocr.raw is not null),
                (
                  any(ml.nlu_classifier(.scan.ocr.raw).intents,
                      .name != "benign"
                  )
                  and any(ml.nlu_classifier(.scan.ocr.raw).entities,
                          .name in ("urgency", "request")
                  )
                )
        )
    )
  )
)
// negate replies
and (length(headers.references) == 0 or headers.in_reply_to is null)

// Negate common marketing mailers
and not regex.icontains(sender.display_name,
                        'HR (?:Events|Expert|Support Center|Studies|Knowledge Cloud|News Library|Crowd|Solutions|Interests)|HR and People Operations'
)
and not (
  // Constant Contact
  any(headers.hops,
      strings.icontains(.authentication_results.spf_details.designator,
                        "constantcontact.com"
      )
  )
  or any(headers.hops,
         strings.icontains(.received_spf.designator, "constantcontact.com")
  )
  or (
    (
      any(headers.hops,
          .index == 0
          and any(.authentication_results.dkim_details,
                  .domain == "auth.ccsend.com"
          )
      )
    )
    and headers.auth_summary.dmarc.pass
  )
  or any(headers.references, strings.iends_with(., "ccsend.com"))
  // Hubspot
  or any(headers.hops,
         strings.icontains(.authentication_results.spf_details.designator,
                           "hubspotemail.net"
         )
  )
)
and sender.email.domain.root_domain not in~ (
  'medicare.gov',
  'farmers.com',
  'uhc.com',
  'blueshieldca.com',
  'corestream.com'
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
// All attachments are images or 0 attachments
and (
  (
    length(attachments) > 0
    and all(attachments, .file_type in $file_types_images)
  )
  or length(attachments) == 0
)
and length(filter(body.links, .href_url.scheme != 'mailto')) > 0
and (
  any(ml.logo_detect(file.message_screenshot()).brands,
      .name == "Adobe" and .confidence in ("high")
  )
  or (
    strings.icontains(body.current_thread.text, "adobe")
    and not strings.icontains(body.current_thread.text, "adobe marketplace")
    and not strings.icontains(body.current_thread.text, "adobe analytics")
    and (
      // Leverage topic analysis to pick up on themes
      (
        length(ml.nlu_classifier(body.current_thread.text).topics) == 1
        and all(ml.nlu_classifier(body.current_thread.text).topics,
                .name == "File Sharing and Cloud Services"
                and .confidence != "low"
        )
      )
      // Key phrases if topic anlayis doesn't match
      or strings.icontains(body.current_thread.text, 'review the document')
      or strings.icontains(body.current_thread.text, 'access file')
      or strings.icontains(body.current_thread.text, 'pending document')
      or any(body.links, strings.ilike(.display_text, 'review and sign'))
      or any(body.links, strings.ilike(.display_text, 'open document'))
    )
    and length(body.current_thread.text) < 2000
  )
)
and (
  (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    strings.ilike(beta.ocr(file.message_screenshot()).text,
                  "*review*",
                  "*sign*",
                  "*view*",
                  "open",
                  "*completed document*",
                  "*open agreement*",
                  "*open document*"
    )
    and not strings.ilike(beta.ocr(file.message_screenshot()).text,
                          "*view this email*",
                          "*view*browser*",
                          "*view online*",
                          "*business review*"
    )
  )
  or any(body.links,
         strings.ilike(.display_text,
                       "*review*",
                       "*sign*",
                       "*view*",
                       "open",
                       "*completed document*",
                       "*open agreement*",
                       "*open document*",
                       "*continue*"
         )
         and not strings.ilike(.display_text,
                               "*view this email*",
                               "*view*browser*",
                               "*view online*"
         )
  )
)
// Negate replies & forwards
and (
  (
    (length(headers.references) > 0 or headers.in_reply_to is null)
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "RES:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject,
                        '^\[?/{0,2}(EXT|EXTERNAL)\]?/{0,2}[: ]\s*(RE|FWD?|FW|AW|TR|ODG|答复):.*'
        )
      )
    )
  )
  or length(headers.references) == 0
)
// Negate certain common topics
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Advertising and Promotions",
              "Events and Webinars",
              "Professional and Career Development",
              "Newsletters and Digests"
            )
            and .confidence != "low"
)
and (
  (
    headers.auth_summary.spf.pass
    and headers.auth_summary.dmarc.pass
    and (
      not profile.by_sender().solicited
      or profile.by_sender().any_messages_malicious_or_spam
      or profile.by_sender_email().days_since.last_contact > 14
    )
    and not profile.by_sender().any_messages_benign
    // Negate affiliates, sub-products & legitimate domains
    and not sender.email.domain.root_domain in (
      "adobe-events.com",
      "frame.io",
      "nudgesecurity.io",
      "adobesignsandbox.com",
      "magento.com",
      "workfront.com"
    )
    // Continued
    and not any(headers.domains, .root_domain == "zohomail.com")
    and not strings.iends_with(headers.message_id, 'omniture.com>')
  )
  or not headers.auth_summary.spf.pass
  or headers.auth_summary.spf.pass is null
  or not headers.auth_summary.dmarc.pass
  or headers.auth_summary.dmarc.pass is null
)
// Negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and sender.display_name in~ (
  'RS-Plan-Admin@adp.com',
  'ADP',
  'SecurityServices_NoReply@adp.com'
)
and sender.email.domain.root_domain not in~ (
  'adp.com',
  'adpsurveys.com',
  'adp.com.br'
)
and sender.email.email not in $recipient_emails

type.inbound
and not any(headers.hops,
            any(.fields,
                .name == 'X-Amazon-Mail-Relay-Type' and .value == "notification"
            )
)
and (
  regex.icontains(sender.display_name,
                  '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay|marketplace|\.com)|ᵃ⤻ᶻ'
  )
  or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1
  or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1
  or strings.ilevenshtein(sender.display_name, 'amazon marketplace') <= 1
  or strings.ilevenshtein(sender.display_name, 'amazon customer support') <= 1
  or regex.icontains(sender.display_name,
                     "prime (?:subscription|notification|support)"
  )
  or regex.imatch(sender.display_name,
                  '^(?:amazon\s)?prime (?:deals?|store)$',
                  'amazon'
  )
  or strings.ilike(subject.subject, "*prime membership*")
  // prime subscription id ##
  or (
    strings.icontains(subject.base, "prime")
    and regex.icontains(body.current_thread.text, 'subscription\s+id\s?.\s\w+')
  )
  or (
    strings.ilevenshtein(sender.display_name, 'amazon') <= 1
    and sender.email.domain.root_domain in $free_email_providers
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Security and Authentication",
              "Secure Message",
              "Reminders and Notifications",
              "Order Confirmations",
              "Customer Service and Support"
            )
    )
    and strings.icontains(body.current_thread.text, "amazon")
  )
)
// negate listservs
and not (
  any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
  and strings.contains(sender.display_name, "via")
)
and sender.email.domain.root_domain not in~ (
  'amazon.com',
  'amazon.com.au',
  'amazon.de',
  'amazon.es',
  'amazon.fr',
  'amazon.it',
  'amazon.in',
  'amazon.lu',
  'amazon.nl',
  'amazonsellerservices.com',
  'amazon.ae',
  'amazon.sa',
  'amazon.com.sg',
  'amazon.co.uk',
  'amazon.co.jp',
  'amazon.com.mx',
  'amazon.com.br',
  'amazon.com.tr',
  'amazon.cn',
  'amazon.ca',
  'amazon.sg',
  'amazonaws.cn',
  'amazonpay.in',
  'amazonpay.com',
  'q4inc.com',
  'synchronybank.com',
  'opodo.com',
  'flynas.com',
  'amazonmusic.com',
  'blink.com',
  'affirm.com',
  'amazon.work',
  'amazon.jobs',
  'rocketmoney.com',
  'registrar.amazon',
  'amazonworkspaces.com',
  'awsapps.com',
  'aws.com',
  'awsevents.com',
  'amazon.se',
  'amazon.ie',
  'amazonconnect.com',
  'aws-experience.com',
  'proofpointessentials.com',
  'area1security.com',
  'marketplace.aws',
  'quicksight.aws'
)

// negate amazon.com.be explicitly, this cannot be part of the root_domain set above as it uses the PSL (Public suffix list) for parsing and com.be is owned by amazon directly.
and sender.email.domain.domain not in~ ('amazon.com.be')
and sender.email.email not in $recipient_emails
and sender.email.domain.domain not in $org_domains

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and (
  strings.ilike(sender.display_name, "amazon*")
  or any(attachments, strings.icontains(.file_name, "amazon"))
  or any(attachments,
         (.file_type in $file_types_images or .file_type == "pdf")
         and any(file.explode(.), strings.icontains(.scan.ocr.raw, "amazon"))
  )
)
and any(attachments,
        (.file_type in $file_types_images or .file_type == "pdf")
        and any(ml.logo_detect(.).brands,
                .name == "Amazon" and .confidence in~ ("medium", "high")
        )
        and (
          any(file.explode(.),
              any(ml.nlu_classifier(.scan.ocr.raw).intents,
                  .name != "benign" and .confidence == "high"
              )
          )
          or any(ml.nlu_classifier(body.current_thread.text).intents,
                 .name != "benign" and .confidence == "high"
          )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and sender.email.domain.root_domain not in~ (
  'a2z.com',
  'amazon.com',
  'amazon.com.au',
  'amazon.co.uk',
  'amazon.de',
  'amazon.es',
  'amazon.fr',
  'amazon.it',
  'amazon.in',
  'amazon.lu',
  'amazon.com.au',
  'amazonsellerservices.com',
  'amazon.ae',
  'amazon.sa',
  'amazon.cn',
  'amazon.ca',
  'amazon.com.mx',
  'amazon.com.br',
  'amazon.ph',
  'amazon.sg',
  'amazon.com.tr',
  'amazonpay.in',
  'amazonpay.com',
  'synchronybank.com',
  'aws.com'
)

type.inbound
and (
  regex.icontains(strings.replace_confusables(sender.display_name),
                  'american ?express'
  )
  or strings.ilike(sender.display_name, "*amer?can expres*")
  or strings.ilevenshtein(sender.display_name, 'american express') <= 2
  or strings.icontains(body.current_thread.text,
                       'american express customer service'
  )
  or strings.ilike(sender.email.domain.domain, '*americanexpress*')
)
and sender.email.domain.root_domain not in (
  'aexp.com',
  'americanexpress.ae',
  'americanexpress.com',
  'americanexpress.co.uk',
  'americanexpress.com.bh',
  'aexpfeedback.com',
  'amexnetwork.com',
  'accountonline.com',
  'transunion.com',
  'amexgiftcard.com',
  'amexgbt.com',
  'herrickstravelamex.com',
  'citi.com',
  'secure.com',
  'nectar.com',
  'accentinfomedia.com',
  'egencia.com'
)
and sender.email.domain.domain not in (
  'accountprotection.microsoft.com',
  'amex.membershipmail.net'
)
and not profile.by_sender().solicited

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and regex.icontains(sender.display_name, '(?:claude|anthropic)')
// sender display name with claude, anthropic - created less than 90 days
and network.whois(sender.email.domain).days_old <= 90

// common theme for suspicious claude, anthropic
and 2 of (
  strings.icontains(body.current_thread.text, "ad account"),
  strings.icontains(body.current_thread.text, "claude ads"),
  strings.icontains(body.current_thread.text, "trial access"),
  strings.icontains(body.current_thread.text, "subscription"),
  strings.icontains(body.current_thread.text, "workspace"),
  strings.icontains(body.current_thread.text, 'ads team'),
  strings.icontains(body.current_thread.text, 'google ads'),
  regex.icontains(body.current_thread.text, "connect.{0,30}account"),
  regex.icontains(body.current_thread.text, '\banthropic\s+(?:team|pbc)\b'),
  2 of (
    strings.icontains(body.current_thread.text, '548 Market Street'),
    strings.icontains(body.current_thread.text, 'San Francisco'),
    strings.icontains(body.current_thread.text, 'CA 94104')
  ),
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "sender"
      and strings.icontains(.text, "Claude", "Anthropic")
      and strings.iends_with(.text, "Team")
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and (
  sender.display_name =~ 'apple developer'
  or strings.ilevenshtein(sender.display_name, 'apple developer') <= 2
)
and sender.email.domain.root_domain !~ 'apple.com'
and sender.email.email not in $recipient_emails

type.inbound
and length(filter(body.links, .href_url.domain.valid)) < 25
and (
  strings.ilike(sender.display_name, '*aramco*')
  or strings.ilevenshtein(sender.display_name, 'aramco') <= 1
  or strings.ilike(sender.email.domain.domain, '*aramco*')
  or strings.ilike(subject.subject, '*aramco*')
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial" or .name == "request"
)
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        strings.ilike(.text, "*aramco*")
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "urgency"
    )
  )
  or regex.icount(body.current_thread.text, "vendor|supplier") > 3
  or any(headers.reply_to, .email.domain.root_domain in $free_email_providers)
  or network.whois(sender.email.domain).days_old <= 90
  or any(headers.reply_to, network.whois(.email.domain).days_old < 90)
)
// Aramco domain negations
and sender.email.domain.root_domain not in~ (
  'aramco.com',
  'aramcoamericas.com',
  'aramcoventures.com',
  'aramcoworld.com',
  'aramcodigital.com',
  'aramcoeurope.com'
)
// negate emails sent by the Aston Martin Aramco F1 Team
and sender.email.domain.root_domain != "astonmartinf1.com"
and not strings.icontains(subject.subject, 'Aston Martin')
and not regex.icontains(subject.subject, 'Formula (?:One|1)', '\bF1\b')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and strings.icontains(body.current_thread.text, "authentisign")
and (
  regex.icontains(body.current_thread.text, 'signing (?:name|party)')
  or strings.ilike(sender.display_name, '*authentisign*')
  or strings.ilevenshtein(sender.display_name, 'authentisign') <= 1
  or strings.ilike(sender.email.domain.domain, '*authentisign*')
)
and (
  sender.email.domain.root_domain != "authentisign.com"
  or (
    sender.email.domain.root_domain == "authentisign.com"
    and not (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
  )
)

type.inbound
and (
  sender.display_name =~ 'bank of america'
  or strings.ilevenshtein(sender.display_name, 'bank of america') <= 2
  or strings.ilike(sender.email.domain.domain, '*bankofamerica*')
)
and sender.email.domain.root_domain not in~ (
  'bankofamerica.com',
  'transunion.com',
  'bofa.com',
  'bofamerchantservices.com'
)
and (
  sender.email.email not in $recipient_emails
  or (
    length(recipients.to) == 1
    and sender.email.email == recipients.to[0].email.email
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and (
  strings.ilike(sender.display_name, '*barracuda*')
  or strings.ilevenshtein(sender.display_name, 'barracuda') <= 1
  or strings.ilike(sender.email.domain.domain, '*barracuda*')
)
and sender.email.domain.root_domain not in (
  'barracuda.com',
  'barracudamsp.com',
  'barracudanetworks.com',
  'netsuite.com',

  // hockey team
  'sharkssports.net',
  'sjbarracuda.com',

  // Barracuda Barcatering
  'barracuda-barcatering.de',

  // Barracuda Events Team
  'worldspan.co.uk',

  // Barracudas Day Camps
  'barracudas.co.uk',

  // BarracudaShoes
  'barracudashoes.it'
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)