Detection rules › Sublime MQL
Brand impersonation: Coinbase
Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials or related information.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
strings.ilike(strings.replace_confusables(sender.display_name), '*coinbase*')
or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
'coinbase'
) <= 1
or strings.ilike(sender.email.domain.domain, '*coinbase*')
)
and not (
sender.email.domain.root_domain in (
'coinbase.com',
'q4inc.com',
'sendsafely.com' // used by Coinbase for verification codes
)
and headers.auth_summary.dmarc.pass
)
and (
// if this comes from a free email provider,
// flag if org has never sent an email to sender's email before
(
sender.email.domain.root_domain in $free_email_providers
and sender.email.email not in $recipient_emails
)
// if this comes from a custom domain,
// flag if org has never sent an email to sender's domain before
or (
sender.email.domain.root_domain not in $free_email_providers
and sender.email.domain.domain not in $recipient_domains
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials or related information.
- inbound message
any of:
- strings.replace_confusables(sender.display_name) matches '*coinbase*'
- strings.replace_confusables(sender.display_name) is similar to 'coinbase'
- sender.email.domain.domain matches '*coinbase*'
not:
all of:
- sender.email.domain.root_domain in ('coinbase.com', 'q4inc.com', 'sendsafely.com')
- headers.auth_summary.dmarc.pass
any of:
all of:
- sender.email.domain.root_domain in $free_email_providers
- sender.email.email not in $recipient_emails
all of:
- sender.email.domain.root_domain not in $free_email_providers
- sender.email.domain.domain not in $recipient_domains
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: strings.ilevenshtein, strings.ilike, strings.replace_confusables. Reference lists: $free_email_providers, $high_trust_sender_root_domains, $recipient_domains, $recipient_emails.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *coinbase* |
strings.ilevenshtein | fuzzy | coinbase |
sender.email.domain.root_domain | member | coinbase.com |
sender.email.domain.root_domain | member | q4inc.com |
sender.email.domain.root_domain | member | sendsafely.com |