Detection rules › Sublime MQL

Brand impersonation: Box file sharing service

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating Box file sharing service by identifying Box logos, collaboration-related language, or Box company address information from senders not associated with the legitimate box.com domain.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and (
  (
    any(ml.logo_detect(file.message_screenshot()).brands, .name == "Box")
    and any([body.current_thread.text, subject.subject],
            regex.icontains(.,
                            'invited you to.{0,10}(?:view|edit|work together|collaborate)',
                            'items were (?:deleted|added)'
            )
    )
  )
  // Box address from footer
  or 2 of (
    strings.icontains(body.current_thread.text, 'About Box'),
    strings.icontains(body.current_thread.text, '900 Jefferson Ave'),
    strings.icontains(body.current_thread.text, 'Redwood City, CA 94063')
  )
  or strings.icontains(body.current_thread.text,
                       "who is using SignRequest.com, an electronic signature tool"
  )
  or strings.icontains(body.current_thread.text, "sent by SignRequest BV")
)
and not (
  sender.email.domain.root_domain in (
    "box.com",
    "liftoff.io",
    "signrequest.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// not a forward or reply
and (headers.in_reply_to is null or length(headers.references) == 0)
// negation for messages traversing box.com
// happens with custom sender domains
and not (
  any(headers.domains, .root_domain == "box.com")
  and headers.auth_summary.spf.pass
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

Detects messages impersonating Box file sharing service by identifying Box logos, collaboration-related language, or Box company address information from senders not associated with the legitimate box.com domain.

  1. inbound message
  2. any of:
    • all of:
      • any of ml.logo_detect(file.message_screenshot()).brands where:
        • .name is 'Box'
      • any of [body.current_thread.text, subject.subject] where:
        • . matches any of 2 patterns
          • invited you to.{0,10}(?:view|edit|work together|collaborate)
          • items were (?:deleted|added)
    • at least 2 of:
      • body.current_thread.text contains 'About Box'
      • body.current_thread.text contains '900 Jefferson Ave'
      • body.current_thread.text contains 'Redwood City, CA 94063'
    • body.current_thread.text contains 'who is using SignRequest.com, an electronic signature tool'
    • body.current_thread.text contains 'sent by SignRequest BV'
  3. not:
    • all of:
      • sender.email.domain.root_domain in ('box.com', 'liftoff.io', 'signrequest.com')
      • coalesce(headers.auth_summary.dmarc.pass)
  4. not:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • coalesce(headers.auth_summary.dmarc.pass)
  5. any of:
    • headers.in_reply_to is missing
    • length(headers.references) is 0
  6. not:
    • all of:
      • any of headers.domains where:
        • .root_domain is 'box.com'
      • headers.auth_summary.spf.pass
      • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.domains, headers.domains[].root_domain, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, regex.icontains, strings.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (12)

FieldMatchValue
ml.logo_detect(file.message_screenshot()).brands[].nameequalsBox
regex.icontainsregexinvited you to.{0,10}(?:view|edit|work together|collaborate)
regex.icontainsregexitems were (?:deleted|added)
strings.icontainssubstringAbout Box
strings.icontainssubstring900 Jefferson Ave
strings.icontainssubstringRedwood City, CA 94063
strings.icontainssubstringwho is using SignRequest.com, an electronic signature tool
strings.icontainssubstringsent by SignRequest BV
sender.email.domain.root_domainmemberbox.com
sender.email.domain.root_domainmemberliftoff.io
sender.email.domain.root_domainmembersignrequest.com
headers.domains[].root_domainequalsbox.com