Detection rules › Sublime MQL
Brand impersonation: Aramco
Impersonation of the petroleum and natural gas company Saudi Aramco.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(filter(body.links, .href_url.domain.valid)) < 25
and (
strings.ilike(sender.display_name, '*aramco*')
or strings.ilevenshtein(sender.display_name, 'aramco') <= 1
or strings.ilike(sender.email.domain.domain, '*aramco*')
or strings.ilike(subject.subject, '*aramco*')
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "financial" or .name == "request"
)
and (
(
any(ml.nlu_classifier(body.current_thread.text).entities,
strings.ilike(.text, "*aramco*")
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "urgency"
)
)
or regex.icount(body.current_thread.text, "vendor|supplier") > 3
or any(headers.reply_to, .email.domain.root_domain in $free_email_providers)
or network.whois(sender.email.domain).days_old <= 90
or any(headers.reply_to, network.whois(.email.domain).days_old < 90)
)
// Aramco domain negations
and sender.email.domain.root_domain not in~ (
'aramco.com',
'aramcoamericas.com',
'aramcoventures.com',
'aramcoworld.com',
'aramcodigital.com',
'aramcoeurope.com'
)
// negate emails sent by the Aston Martin Aramco F1 Team
and sender.email.domain.root_domain != "astonmartinf1.com"
and not strings.icontains(subject.subject, 'Aston Martin')
and not regex.icontains(subject.subject, 'Formula (?:One|1)', '\bF1\b')
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of the petroleum and natural gas company Saudi Aramco.
- inbound message
- length(filter(body.links, .href_url.domain.valid)) < 25
any of:
- sender.display_name matches '*aramco*'
- sender.display_name is similar to 'aramco'
- sender.email.domain.domain matches '*aramco*'
- subject.subject matches '*aramco*'
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere any holds:- .name is 'financial'
- .name is 'request'
any of:
all of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .text matches '*aramco*'
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'urgency'
- regex.icount(body.current_thread.text, 'vendor|supplier') > 3
any of
headers.reply_towhere:- .email.domain.root_domain in $free_email_providers
- network.whois(sender.email.domain).days_old ≤ 90
any of
headers.reply_towhere:- network.whois(.email.domain).days_old < 90
- sender.email.domain.root_domain not in ('aramco.com', 'aramcoamericas.com', 'aramcoventures.com', 'aramcoworld.com', 'aramcodigital.com', 'aramcoeurope.com')
- sender.email.domain.root_domain is not 'astonmartinf1.com'
not:
- subject.subject contains 'Aston Martin'
not:
subject.subject matches any of 2 patterns
Formula (?:One|1)\bF1\b
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.valid, headers.auth_summary.dmarc.pass, headers.reply_to, headers.reply_to[].email.domain, headers.reply_to[].email.domain.root_domain, sender.display_name, sender.email.domain, sender.email.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, network.whois, regex.icontains, regex.icount, strings.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $free_email_providers, $high_trust_sender_root_domains.
Indicators matched (15)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *aramco* |
strings.ilevenshtein | fuzzy | aramco |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | financial |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | request |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | urgency |
regex.icount | regex | vendor|supplier |
sender.email.domain.root_domain | member | aramco.com |
sender.email.domain.root_domain | member | aramcoamericas.com |
sender.email.domain.root_domain | member | aramcoventures.com |
sender.email.domain.root_domain | member | aramcoworld.com |
sender.email.domain.root_domain | member | aramcodigital.com |
sender.email.domain.root_domain | member | aramcoeurope.com |
3 more
strings.icontains | substring | Aston Martin |
regex.icontains | regex | Formula (?:One|1) |
regex.icontains | regex | \bF1\b |