Detection rules › Sublime MQL

Brand impersonation: American Express (AMEX)

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of the credit card provider American Express.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Rule body MQL

type.inbound
and (
  regex.icontains(strings.replace_confusables(sender.display_name),
                  'american ?express'
  )
  or strings.ilike(sender.display_name, "*amer?can expres*")
  or strings.ilevenshtein(sender.display_name, 'american express') <= 2
  or strings.icontains(body.current_thread.text,
                       'american express customer service'
  )
  or strings.ilike(sender.email.domain.domain, '*americanexpress*')
)
and sender.email.domain.root_domain not in (
  'aexp.com',
  'americanexpress.ae',
  'americanexpress.com',
  'americanexpress.co.uk',
  'americanexpress.com.bh',
  'aexpfeedback.com',
  'amexnetwork.com',
  'accountonline.com',
  'transunion.com',
  'amexgiftcard.com',
  'amexgbt.com',
  'herrickstravelamex.com',
  'citi.com',
  'secure.com',
  'nectar.com',
  'accentinfomedia.com',
  'egencia.com'
)
and sender.email.domain.domain not in (
  'accountprotection.microsoft.com',
  'amex.membershipmail.net'
)
and not profile.by_sender().solicited

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Impersonation of the credit card provider American Express.

  1. inbound message
  2. any of:
    • strings.replace_confusables(sender.display_name) matches 'american ?express'
    • sender.display_name matches '*amer?can expres*'
    • sender.display_name is similar to 'american express'
    • body.current_thread.text contains 'american express customer service'
    • sender.email.domain.domain matches '*americanexpress*'
  3. sender.email.domain.root_domain not in ('aexp.com', 'americanexpress.ae', 'americanexpress.com', 'americanexpress.co.uk', 'americanexpress.com.bh', 'aexpfeedback.com', 'amexnetwork.com', 'accountonline.com', 'transunion.com', 'amexgiftcard.com', 'amexgbt.com', 'herrickstravelamex.com', 'citi.com', 'secure.com', 'nectar.com', 'accentinfomedia.com', 'egencia.com')
  4. sender.email.domain.domain not in ('accountprotection.microsoft.com', 'amex.membershipmail.net')
  5. not:
    • profile.by_sender().solicited
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike, strings.replace_confusables. Reference lists: $high_trust_sender_root_domains.

Indicators matched (24)

FieldMatchValue
regex.icontainsregexamerican ?express
strings.ilikesubstring*amer?can expres*
strings.ilevenshteinfuzzyamerican express
strings.icontainssubstringamerican express customer service
strings.ilikesubstring*americanexpress*
sender.email.domain.root_domainmemberaexp.com
sender.email.domain.root_domainmemberamericanexpress.ae
sender.email.domain.root_domainmemberamericanexpress.com
sender.email.domain.root_domainmemberamericanexpress.co.uk
sender.email.domain.root_domainmemberamericanexpress.com.bh
sender.email.domain.root_domainmemberaexpfeedback.com
sender.email.domain.root_domainmemberamexnetwork.com
12 more
sender.email.domain.root_domainmemberaccountonline.com
sender.email.domain.root_domainmembertransunion.com
sender.email.domain.root_domainmemberamexgiftcard.com
sender.email.domain.root_domainmemberamexgbt.com
sender.email.domain.root_domainmemberherrickstravelamex.com
sender.email.domain.root_domainmemberciti.com
sender.email.domain.root_domainmembersecure.com
sender.email.domain.root_domainmembernectar.com
sender.email.domain.root_domainmemberaccentinfomedia.com
sender.email.domain.root_domainmemberegencia.com
sender.email.domain.domainmemberaccountprotection.microsoft.com
sender.email.domain.domainmemberamex.membershipmail.net