Detection rules › Sublime MQL
Brand impersonation: Box file sharing service
Detects messages impersonating Box file sharing service by identifying Box logos, collaboration-related language, or Box company address information from senders not associated with the legitimate box.com domain.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
(
any(ml.logo_detect(file.message_screenshot()).brands, .name == "Box")
and any([body.current_thread.text, subject.subject],
regex.icontains(.,
'invited you to.{0,10}(?:view|edit|work together|collaborate)',
'items were (?:deleted|added)'
)
)
)
// Box address from footer
or 2 of (
strings.icontains(body.current_thread.text, 'About Box'),
strings.icontains(body.current_thread.text, '900 Jefferson Ave'),
strings.icontains(body.current_thread.text, 'Redwood City, CA 94063')
)
or strings.icontains(body.current_thread.text,
"who is using SignRequest.com, an electronic signature tool"
)
or strings.icontains(body.current_thread.text, "sent by SignRequest BV")
)
and not (
sender.email.domain.root_domain in (
"box.com",
"liftoff.io",
"signrequest.com"
)
and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
// not a forward or reply
and (headers.in_reply_to is null or length(headers.references) == 0)
// negation for messages traversing box.com
// happens with custom sender domains
and not (
any(headers.domains, .root_domain == "box.com")
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages impersonating Box file sharing service by identifying Box logos, collaboration-related language, or Box company address information from senders not associated with the legitimate box.com domain.
- inbound message
any of:
all of:
any of
ml.logo_detect(file.message_screenshot()).brandswhere:- .name is 'Box'
any of
[body.current_thread.text, subject.subject]where:. matches any of 2 patterns
invited you to.{0,10}(?:view|edit|work together|collaborate)items were (?:deleted|added)
at least 2 of:
- body.current_thread.text contains 'About Box'
- body.current_thread.text contains '900 Jefferson Ave'
- body.current_thread.text contains 'Redwood City, CA 94063'
- body.current_thread.text contains 'who is using SignRequest.com, an electronic signature tool'
- body.current_thread.text contains 'sent by SignRequest BV'
not:
all of:
- sender.email.domain.root_domain in ('box.com', 'liftoff.io', 'signrequest.com')
- coalesce(headers.auth_summary.dmarc.pass)
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
any of:
- headers.in_reply_to is missing
- length(headers.references) is 0
not:
all of:
any of
headers.domainswhere:- .root_domain is 'box.com'
- headers.auth_summary.spf.pass
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.domains, headers.domains[].root_domain, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
ml.logo_detect(file.message_screenshot()).brands[].name | equals | Box |
regex.icontains | regex | invited you to.{0,10}(?:view|edit|work together|collaborate) |
regex.icontains | regex | items were (?:deleted|added) |
strings.icontains | substring | About Box |
strings.icontains | substring | 900 Jefferson Ave |
strings.icontains | substring | Redwood City, CA 94063 |
strings.icontains | substring | who is using SignRequest.com, an electronic signature tool |
strings.icontains | substring | sent by SignRequest BV |
sender.email.domain.root_domain | member | box.com |
sender.email.domain.root_domain | member | liftoff.io |
sender.email.domain.root_domain | member | signrequest.com |
headers.domains[].root_domain | equals | box.com |