detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Blockchain.com

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of Blockchain.com, usually for credential theft.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers.auth_summary
sender
sender.email
type

Rule body MQL

type.inbound
and (
  regex.imatch(sender.display_name, '\bblockchain\b')
  or strings.ilevenshtein(sender.display_name, 'blockchain') <= 1
  or strings.ilike(sender.email.domain.domain, '*blockchain.com*')
  or any(body.links,
         strings.ilevenshtein(.href_url.domain.root_domain, 'blockchain') == 1
  )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Educational and Research", "Advertising and Promotions")
            and .confidence == "high"
)
and not (
  sender.email.domain.root_domain in~ (
    'blockchain.com',
    'wxblockchain.com',
    'ai-blockchain.com',
    'envisionblockchain.com'
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender_email().solicited

Detection logic

Scope: inbound message.

Impersonation of Blockchain.com, usually for credential theft.

  1. inbound message
  2. any of:
    • sender.display_name matches '\\bblockchain\\b'
    • sender.display_name is similar to 'blockchain'
    • sender.email.domain.domain matches '*blockchain.com*'
    • any of body.links where:
      • .href_url.domain.root_domain is similar to 'blockchain'
  3. not:
    • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
      • .name in ('Educational and Research', 'Advertising and Promotions')
      • .confidence is 'high'
  4. not:
    • all of:
      • sender.email.domain.root_domain in ('blockchain.com', 'wxblockchain.com', 'ai-blockchain.com', 'envisionblockchain.com')
      • coalesce(headers.auth_summary.dmarc.pass)
  5. not:
    • profile.by_sender_email().solicited

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, regex.imatch, strings.ilevenshtein, strings.ilike.

Indicators matched (10)

FieldMatchValue
regex.imatchregex\bblockchain\b
strings.ilevenshteinfuzzyblockchain
strings.ilikesubstring*blockchain.com*
ml.nlu_classifier(body.current_thread.text).topics[].namememberEducational and Research
ml.nlu_classifier(body.current_thread.text).topics[].namememberAdvertising and Promotions
ml.nlu_classifier(body.current_thread.text).topics[].confidenceequalshigh
sender.email.domain.root_domainmemberblockchain.com
sender.email.domain.root_domainmemberwxblockchain.com
sender.email.domain.root_domainmemberai-blockchain.com
sender.email.domain.root_domainmemberenvisionblockchain.com