Detection rules › Sublime MQL
Brand impersonation: American Express (AMEX)
Impersonation of the credit card provider American Express.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
regex.icontains(strings.replace_confusables(sender.display_name),
'american ?express'
)
or strings.ilike(sender.display_name, "*amer?can expres*")
or strings.ilevenshtein(sender.display_name, 'american express') <= 2
or strings.icontains(body.current_thread.text,
'american express customer service'
)
or strings.ilike(sender.email.domain.domain, '*americanexpress*')
)
and sender.email.domain.root_domain not in (
'aexp.com',
'americanexpress.ae',
'americanexpress.com',
'americanexpress.co.uk',
'americanexpress.com.bh',
'aexpfeedback.com',
'amexnetwork.com',
'accountonline.com',
'transunion.com',
'amexgiftcard.com',
'amexgbt.com',
'herrickstravelamex.com',
'citi.com',
'secure.com',
'nectar.com',
'accentinfomedia.com',
'egencia.com'
)
and sender.email.domain.domain not in (
'accountprotection.microsoft.com',
'amex.membershipmail.net'
)
and not profile.by_sender().solicited
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of the credit card provider American Express.
- inbound message
any of:
- strings.replace_confusables(sender.display_name) matches 'american ?express'
- sender.display_name matches '*amer?can expres*'
- sender.display_name is similar to 'american express'
- body.current_thread.text contains 'american express customer service'
- sender.email.domain.domain matches '*americanexpress*'
- sender.email.domain.root_domain not in ('aexp.com', 'americanexpress.ae', 'americanexpress.com', 'americanexpress.co.uk', 'americanexpress.com.bh', 'aexpfeedback.com', 'amexnetwork.com', 'accountonline.com', 'transunion.com', 'amexgiftcard.com', 'amexgbt.com', 'herrickstravelamex.com', 'citi.com', 'secure.com', 'nectar.com', 'accentinfomedia.com', 'egencia.com')
- sender.email.domain.domain not in ('accountprotection.microsoft.com', 'amex.membershipmail.net')
not:
- profile.by_sender().solicited
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike, strings.replace_confusables. Reference lists: $high_trust_sender_root_domains.
Indicators matched (24)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | american ?express |
strings.ilike | substring | *amer?can expres* |
strings.ilevenshtein | fuzzy | american express |
strings.icontains | substring | american express customer service |
strings.ilike | substring | *americanexpress* |
sender.email.domain.root_domain | member | aexp.com |
sender.email.domain.root_domain | member | americanexpress.ae |
sender.email.domain.root_domain | member | americanexpress.com |
sender.email.domain.root_domain | member | americanexpress.co.uk |
sender.email.domain.root_domain | member | americanexpress.com.bh |
sender.email.domain.root_domain | member | aexpfeedback.com |
sender.email.domain.root_domain | member | amexnetwork.com |
12 more
sender.email.domain.root_domain | member | accountonline.com |
sender.email.domain.root_domain | member | transunion.com |
sender.email.domain.root_domain | member | amexgiftcard.com |
sender.email.domain.root_domain | member | amexgbt.com |
sender.email.domain.root_domain | member | herrickstravelamex.com |
sender.email.domain.root_domain | member | citi.com |
sender.email.domain.root_domain | member | secure.com |
sender.email.domain.root_domain | member | nectar.com |
sender.email.domain.root_domain | member | accentinfomedia.com |
sender.email.domain.root_domain | member | egencia.com |
sender.email.domain.domain | member | accountprotection.microsoft.com |
sender.email.domain.domain | member | amex.membershipmail.net |