Detection rules › Sublime MQL
Brand impersonation: AuthentiSign
Detects messages impersonating AuthentiSign through display name, domain, subject, or body content that either originate from non-AuthentiSign or spoofed domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and strings.icontains(body.current_thread.text, "authentisign")
and (
regex.icontains(body.current_thread.text, 'signing (?:name|party)')
or strings.ilike(sender.display_name, '*authentisign*')
or strings.ilevenshtein(sender.display_name, 'authentisign') <= 1
or strings.ilike(sender.email.domain.domain, '*authentisign*')
)
and (
sender.email.domain.root_domain != "authentisign.com"
or (
sender.email.domain.root_domain == "authentisign.com"
and not (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
)
)
Detection logic
Scope: inbound message.
Detects messages impersonating AuthentiSign through display name, domain, subject, or body content that either originate from non-AuthentiSign or spoofed domains.
- inbound message
- body.current_thread.text contains 'authentisign'
any of:
- body.current_thread.text matches 'signing (?:name|party)'
- sender.display_name matches '*authentisign*'
- sender.display_name is similar to 'authentisign'
- sender.email.domain.domain matches '*authentisign*'
any of:
- sender.email.domain.root_domain is not 'authentisign.com'
all of:
- sender.email.domain.root_domain is 'authentisign.com'
none of:
- headers.auth_summary.spf.pass
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | authentisign |
regex.icontains | regex | signing (?:name|party) |
strings.ilike | substring | *authentisign* |
strings.ilevenshtein | fuzzy | authentisign |
sender.email.domain.root_domain | equals | authentisign.com |