Detection rules › Sublime MQL
Brand impersonation: Bank of America
Impersonation of Bank of America, usually for credential theft.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
sender.display_name =~ 'bank of america'
or strings.ilevenshtein(sender.display_name, 'bank of america') <= 2
or strings.ilike(sender.email.domain.domain, '*bankofamerica*')
)
and sender.email.domain.root_domain not in~ (
'bankofamerica.com',
'transunion.com',
'bofa.com',
'bofamerchantservices.com'
)
and (
sender.email.email not in $recipient_emails
or (
length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of Bank of America, usually for credential theft.
- inbound message
any of:
- sender.display_name is 'bank of america'
- sender.display_name is similar to 'bank of america'
- sender.email.domain.domain matches '*bankofamerica*'
- sender.email.domain.root_domain not in ('bankofamerica.com', 'transunion.com', 'bofa.com', 'bofamerchantservices.com')
any of:
- sender.email.email not in $recipient_emails
all of:
- length(recipients.to) is 1
- sender.email.email is recipients.to[0].email.email
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, recipients.to, recipients.to[0].email.email, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: strings.ilevenshtein, strings.ilike. Reference lists: $high_trust_sender_root_domains, $recipient_emails.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
sender.display_name | equals | bank of america |
strings.ilevenshtein | fuzzy | bank of america |
strings.ilike | substring | *bankofamerica* |
sender.email.domain.root_domain | member | bankofamerica.com |
sender.email.domain.root_domain | member | transunion.com |
sender.email.domain.root_domain | member | bofa.com |
sender.email.domain.root_domain | member | bofamerchantservices.com |