Detection rules › Sublime MQL
Brand impersonation: ADP
Impersonation of the payroll provider ADP. Most commonly seen around US tax season (Q1)
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.display_name in~ (
'RS-Plan-Admin@adp.com',
'ADP',
'SecurityServices_NoReply@adp.com'
)
and sender.email.domain.root_domain not in~ (
'adp.com',
'adpsurveys.com',
'adp.com.br'
)
and sender.email.email not in $recipient_emails
Detection logic
Scope: inbound message.
Impersonation of the payroll provider ADP. Most commonly seen around US tax season (Q1)
- inbound message
- sender.display_name in ('RS-Plan-Admin@adp.com', 'ADP', 'SecurityServices_NoReply@adp.com')
- sender.email.domain.root_domain not in ('adp.com', 'adpsurveys.com', 'adp.com.br')
- sender.email.email not in $recipient_emails
Inspects: sender.display_name, sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $recipient_emails.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
sender.display_name | member | RS-Plan-Admin@adp.com |
sender.display_name | member | ADP |
sender.display_name | member | SecurityServices_NoReply@adp.com |
sender.email.domain.root_domain | member | adp.com |
sender.email.domain.root_domain | member | adpsurveys.com |
sender.email.domain.root_domain | member | adp.com.br |